Zowe Response to eMudhra Certificate Authority Compromise

Published: October 2026 | Zowe Security Workgroup

Zowe Community Security Advisory: Multiple intermediate Certificate Authorities (CAs) operated by eMudhra were recently compromised due to weak cryptographic key generation. Zowe users and administrators are strongly advised to update their language runtimes (including Node.js and Java) and system trust stores across all Zowe components as soon as possible.

Recommended Actions

1. Upgrade Node.js Runtimes

Node.js versions earlier than 26.12.1, 24.22.1, and 22.23.4 bundle vulnerable certificate trust stores. Users of Zowe CLI and server-side Node.js components should upgrade their Node.js runtimes to patched releases:

Node.js v26: Upgrade to >= 26.12.1
Node.js v24: Upgrade to >= 24.22.1
Node.js v22: Upgrade to >= 22.23.4

For users of Zowe Explorer, update your VS Code environment to 1.143.1 or later.

2. Update Java / JVM Environments

Ensure that Java runtime environments (JRE/JDK) powering the Zowe API Mediation Layer and other Java services on z/OS have received the latest security updates from IBM's Java distribution.

3. Inspect Custom Truststores and Certificates

If you have any eMudhra certificate authorities in your z/OS keyrings, remove them and restart Zowe.