October 2026 Security Updates #3 for XCP-ng 8.3 LTS

Security Oct 22, 2026

New security updates are available for XCP-ng 8.3 LTS.

💡

📔 To update, follow this guide. You can also join the discussion on our community forum.

📋Summary

The ca-certificates package shipped with XCP-ng 8.3 includes two eMudhra
intermediate CA certificates whose private keys have been compromised. The
updated package no longer includes the compromised certificates in the trust store.

We recommend updating as soon as your schedule permits.

🔒Security Updates

ca-certificates

VSA-2026-050: eMudhra Intermediate CA Compromise: Mozilla announced that the
private keys of eight eMudhra intermediate certificates have been compromised.
XCP-ng 8.3 ships ca-certificates-2021.2.50-73.1.xcpng8.3, which trusts these
intermediate certificates in the system trust store. An adversary in a
man-in-the-middle position could use them to impersonate websites and read or
modify traffic. The new version ca-certificates-2021.2.50-73.2.xcpng8.3 removes the comprised certificates.