Impact of eMudhra / emSign Intermediate CA Certificate Incident on VMware Tanzu and TrueSource by Broadcom offerings (CVE-2026-111943)

Products

• VMware Tanzu Platform Core
• Concourse for VMware Tanzu
• VMware Cloud Native Runtimes
• VMware Tanzu Application Platform
• VMware Tanzu Application Service
• VMware Tanzu Application Catalog
• VMware Tanzu Platform - Hub

Issue/Introduction

On 10/20/26, eight intermediate Certificate Authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised, causing the revocation and distrust of several certificates. The revoked certificates are included in most browser and operating systems CA Certificates files and can lead to potential Man-in-the-Middle (MITM) spoofing on outbound connections from an unpatched system or application.

The Tanzu division initiated the incident response process immediately upon receiving the certificate authority advisory. 

Multiple components of Tanzu Platform, Tanzu Data Intelligence and most TrueSource artifacts are affected by this issue as well as the application components such as buildpacks and stacks that ship as part of Tanzu Platform.

Furthermore, all Tanzu products and use cases were examined, taking into account 2 distinct risks:

• The risk to customer applications can be mitigated by leveraging new Stemcell, Stack and buildpack patches from Broadcom support portal.. In the case of applications using TrueSource Artifacts, this issue can be mitigated by upgrading to the latest version.

 

• The risk to Tanzu customers receiving updates from the Broadcom Support Portal is minimal due to the BGP, IP and DNS protections Broadcom applies to enterprise distribution services. Tanzu customers are also protected by deploying Tanzu products inside enterprise controlled environments limiting the possibility of DNS spoofing or MITM attack against Tanzu Upgrades. To ensure full protection, patches are available for the all affected components that download artifacts from Broadcom.

 

Resolution

Customers who have applied the patches are not vulnerable to the compromised CA risks.
To ensure all environments are fully protected against these vulnerabilities, customers must update their deployments to the latest patched versions immediately.

Additional Information