early signals AWS security bulletins infra

CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles

// AI summary

AWS identified CVE-2026-111943, a key-generation flaw at eMudhra making intermediate CA private keys recoverable in three affected roots within AWS-owned trust bundles.

// from the source

Bulletin ID: 2026-150-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/24/2026 20:00 PM PDT Summary: AWS identified CVE-2026-111943, a key-generation flaw at external CA eMudhra/emSign that made intermediate CA private keys recoverable. Three roots are affected: AAA Certificate Services, emSign Root TLS CA - G3, and emSign ECC Root CA - G3. They shipped in AWS-owned trust bundles, exposing soft-fail TLS clients to man-in-the-middle risk. AWS is removing the roots.
Read at aws.amazon.com ↗ More from AWS security bulletins

# more from AWS security bulletins

  1. AWS security bulletins infra

    CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes

    aws.amazon.com
  2. AWS security bulletins infra

    CVE-2026-111497: Native Brotli Decoder Remote Code Execution and Memory Disclosure

    aws.amazon.com
  3. AWS security bulletins infra

    CVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents Tools

    aws.amazon.com
  4. AWS security bulletins infra

    CVE-2026-118029 - Unverified ownership of the default Athena query result location in AWS SDK for pandas

    aws.amazon.com
  5. AWS security bulletins infra

    CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass

    aws.amazon.com