# eMudhra Intermediate CA Key Compromise: Interim Mitigation (v4) **URL:** \ **Category:** Security Notices\ **Created:** [October 25, 2026, 1:22pm UTC](https://forum.inductiveautomation.com/t/emudhra-intermediate-ca-key-compromise-interim-mitigation-v4/117596 "2026-10-25T13:22:29Z")\ **Posts on this page:** 1\ **Showing post:** 11
**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\ **Post date:** [November 12, 2026, 6:30pm UTC](https://forum.inductiveautomation.com/t/emudhra-intermediate-ca-key-compromise-interim-mitigation-v4/117596/11 "2026-11-12T18:30:18Z")
**Update: v2.0.1 fixes the Windows script** The Windows script in v2.0.0, `remove-emudhra-roots.ps1`, removes the roots correctly, but on a Windows gateway it leaves the Windows runtime the gateway hands out to clients, `lib\runtime\jre-win.zip`, in a form the launchers can't unpack. Windows Designers and Vision Clients launched from that gateway can then fail to start with: `ZipException: only DEFLATED entries can have EXT descriptor` [v2.0.1](https://github.com/inductiveautomation/ignition-emudhra-mitigation/releases/tag/v2.0.1) fixes this. **Ran v2.0.0 on a Windows gateway?** Run v2.0.1 on that gateway as the README describes: stop the gateway, run the script, then start it. The script rebuilds the archive and reports it as `repaired:`. Every Designer and Vision Client then downloads the fixed runtime once, about 45 MB, including any that downloaded the original runtime after you restored `jre-win.zip.orig`. **Haven't applied the fix yet?** Use v2.0.1. **Nothing to do anywhere else:** Linux and macOS gateways use the shell script, which isn't affected, and on workstations the Windows script only changes each runtime's trust store. --- _[View the full topic](https://forum.inductiveautomation.com/t/emudhra-intermediate-ca-key-compromise-interim-mitigation-v4/117596)._