Microsoft issues offline trust list updates for Windows 11

Microsoft has issued an out-of-band Certificate Trust List (CTL) update for several Windows 11 builds, intended to refresh certificate trust information on computers that cannot connect to Microsoft’s certificate update servers. SecurityOnline says the package is believed to remove the compromised eMudhra G3 root certificate, but presents this as a likely change rather than a confirmed detail.

The update is aimed in particular at air-gapped industrial systems and other isolated environments, where automatic certificate synchronisation is disabled and trust lists may otherwise remain outdated.

Microsoft’s updates are available through the Update Catalog as KB5134130 for Windows 11 23H2, KB5134133 for 24H2, 25H2 and 26H2, and KB5134134 for 26H1. Administrators can download the standalone packages and transfer them to offline systems for deployment. The source says the update changes user-mode and kernel PKI trust lists; it does not change Microsoft UEFI CA 2023 Secure Boot signing certificates.