Access Server: CVE-2026-111943 eMudhra weak CA

Impact on Access Server: Minor

Details:

On October 20, 2026, security researchers disclosed the discovery of eight eMudhra intermediate certificate authority (CA) keys with critical weaknesses introduced during a flawed signing ceremony in 2025. These keys belonged to certificate authorities trusted by public key infrastructure (PKI). Because the private keys were weak, attackers could potentially issue forged certificates, undermining trust in the public internet’s certificate infrastructure.

OpenVPN Access Server relies on public key infrastructure for a limited number of functions. For these functions, Access Server uses the operating system’s ca-certificates package to establish trust. To address the issue, update this package and restart the server to ensure the changes take effect.

VPN connections use a private key infrastructure and aren't affected. Software packages are updated through package managers that use their own verification methods to establish trust. Fixed License activations and subscription updates also use a private key infrastructure and aren't affected.

AWS tiered licensing is the only licensing method that relies on public key infrastructure. However, exploitation within the AWS infrastructure is highly unlikely. Even if exploitation occurred, no confidential data would be at risk.

LDAP over SSL may be affected if it relies on public key infrastructure. However, most configurations use a private key infrastructure. If your configuration relies on public key infrastructure, update the operating system’s ca-certificates package and restart the system to apply the changes.

Remediation:

Update the operating system and restart the system to apply the changes. Ensure the updated ca-certificates package no longer includes the untrustworthy certificate authority keys.

Need help?

If you have questions, submit a support ticket.