What changed
AWS published and then materially updated a bulletin for CVE-2026-111943 after eight eMudhra/emSign intermediate CA private keys proved recoverable. AWS removed affected roots from shared trust bundles, shipped boto3 and botocore 1.43.117 plus Amazon Linux and Corretto updates, refreshed Bottlerocket images and staged CloudFront and load-balancer trust changes.
Why it matters
Agents and AI services commonly call identity providers, origins, webhooks and model endpoints through AWS SDKs and managed networking. A recoverable CA key can turn an apparently valid TLS chain into a false trust signal, so system packages, SDK bundles, container images and managed-service rollout status all matter.
What to do
Inventory workloads that use AWS-owned or custom CA bundles, pin boto3 and botocore 1.43.117 or later, apply Amazon Linux, Corretto and Bottlerocket fixes, verify Windows trust-list updates, and test OIDC, JWT, webhook and origin connections after root removal. Keep revocation checking fail-closed where supported.
Caveat
AWS says clients enforcing revocation fail-closed were not affected after the intermediates were revoked. Managed-service mitigation is staggered, including load-balancer OIDC and JWT updates through 31 October and protection for newly created load balancers by 2 November; custom images, language runtimes and private trust stores need separate review.