GCP-2026-077 — Published: 2026-11-03Description Description Severity Notes Following the private-key compromise of intermediate Certificate Authorities…

Published: 2026-11-03Description Description Severity Notes Following the private-key compromise of intermediate Certificate Authorities (CAs) associated with eMudhra (emSign), outbound TLS connections trusting affected roots—specifically emSign ECC Root CA - G3—are vulnerable to Man-in-the-Middle (MITM) interception. An attacker possessing compromised intermediate keys can issue fraudulent TLS certificates for arbitrary domain names. Outbound HTTPS connections made from Apigee runtimes (such as TargetEndpoints, TargetServers, ServiceCallouts, and outbound JWKS policy lookups) using default or unmanaged system trust stores may accept forged certificates. This security bulletin outlines required remediation steps for Apigee, Apigee Hybrid, Apigee Edge (SaaS), and Apigee Edge for Private Cloud (OPDK). For more information, see the Apigee security bulletin. Medium CVE-2026-111943 CVE-2026-91403