[Base Image] nanoserver: ETA for base image rebuild with updated Disallowed CTL (eMudhra CA compromise / CVE-2026-111943) #659

Activity

1. Xun Jiang/Bruce Jiang (blackpiglet)

   added

   questionFurther information is requestedFurther information is requested

   triageNew and needs attentionNew and needs attention

   on Oct 23, 2026
2. github-actions commented on Oct 23, 2026

   

   github-actionsBot

   on Oct 23, 2026 – with GitHub Actions

   More actions

   Thank you for creating an Issue. Please note that GitHub is not an official channel for Microsoft support requests. To create an official support request, please open a ticket here. Microsoft and the GitHub Community strive to provide a best effort in answering questions and supporting Issues on GitHub.
3. smiezah-msft commented on Oct 27, 2026

   

   smiezah-msft

   on Oct 27, 2026

   Collaborator

   More actions

   Hi Xun Jiang/Bruce Jiang (@blackpiglet), thanks for raising this and for the clear write-up.

   Updated base images are available now, so you don't need to wait for November 10. On October 26, 2026, Microsoft released an out-of-band (OOB) update that is "intended for devices that do not receive current certificate trust list (CTL) updates, including updates to the list of untrusted certificates." Refreshed nanoserver and servercore images built on this update are published on MCR, and the ltsc tags already point to them:

   Windows Server	OOB update	Image tag	Tags pointing to it
   2025	KB5134137	10.0.26100.33674	ltsc2025
   2022	KB5134140	10.0.20348.5773	ltsc2022
   2019	KB5134124	10.0.17763.9378	ltsc2019, 1809

   Recommended next step: pull the updated base image and rebuild. If you pin to a version tag or digest, move to the tag above. This replaces the need for a build-time import of the Disallowed list.

   docker pull mcr.microsoft.com/windows/nanoserver:ltsc2025
   docker image inspect mcr.microsoft.com/windows/nanoserver:ltsc2025 --format "{{.OsVersion}}"
   # Expect 10.0.26100.33674 (10.0.20348.5773 for ltsc2022, 10.0.17763.9378 for ltsc2019)

   One note: applications that ship their own trust store (for example, Java's cacerts or Python's certifi) don't use the Windows certificate stores, so they need their own update.

   If anything in your pipeline prevents you from rebasing right away, let us know and we can help with an interim approach.

   👍React with 👍2Reacted by Xun Jiang/Bruce Jiang and Hervé Le Meur
4. smiezah-msft

   closed this as completedon Oct 28, 2026