Microsoft releases out-of-band Windows fixes with certificate updates

Microsoft has launched an additional out-of-band update for Windows, focusing on certificates rather than an emergency fix for recent issues. This update is applicable to supported operating systems, including Windows 11, Windows Server 2025, and Windows 10. The primary goal is to update the current certificate trust list (CTL) for devices unable to access Microsoft's certificate-update service or where automatic CTL updates are disabled.

The update also includes all the elements from the October 13th release, such as persistent VPN problems and a change potentially disrupting on-premises Exchange Servers. Moreover, there may be irregularities with Smart App Control, audio, and Remote Desktop connections for non-admin users. However, these issues remain unresolved in this patch, so users should be cautious when installing it.

Many devices won't require this version, as certificate list updates typically occur through the regular update service. Nonetheless, if the service is unavailable or not in use, the out-of-band fix could be beneficial, despite the known problems, as it may resolve issues related to verifying certificates used by applications or websites.

The out-of-band update followed Microsoft's response to the compromised eMudhra certificate keys, which were exposed earlier in the month. To address this, Microsoft promptly blocked the affected certificate authorities by updating its Windows Disallowed Certificate Trust List and released a separate CRLSet for Edge and WebView2.

Microsoft disclosed on October 26th that they removed seven certificates linked to the compromised hierarchies: six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list.