Summary

The certificate authority eMudhra disclosed on October 20, 2026 that the private keys for eight of its intermediate CA certificates had been compromised, and revoked them. Anyone holding the private keys for those certificates can issue a certificate that impersonates any websites of service. An attacker in a man-in-the-middle position could use one to intercept or modify an application’s encrypted traffic.

Unity relies on the underlying platform for certificate security. UnityTLS, the TLS library in the Unity Runtime, takes its trusted root certificates from the operating system, so an operating system update that removes the affected root certificate protects Unity applications on that platform. Players should keep their devices up to date and apply any remediation their platform provides. On Windows, Web (WebGL), and Android, the operating system or browser validates certificates and has already blocked the compromised ones, so applications there are protected as long as the device receives its normal security updates.

Unity is releasing updates for Unity 6000.0 and later that add an explicit block for the compromised certificates in UnityTLS and address affected components in the Unity Editor itself. All projects in active development should update to these releases. There is no evidence that this has been exploited against Unity applications, and no impact on users or customers has been identified.

Vulnerability Details

Component: UnityTLS certificate validation in the Unity Runtime, and the bundled CA store

Date publicly disclosed: October 20, 2026

Affected versions: See the Affected Platforms table

Affected versions: See the Unity Editor Version table

Vulnerability type: Improper certificate validation: revoked intermediate certificates are trusted CWE-295

Exploitation Potential

An attacker with a man-in-the-middle position, such as a hostile Wi-Fi network or a compromised router, could present a certificate issued with one of the compromised keys. An unpatched application on an affected platform would accept it, letting the attacker read traffic (analytics data, service access tokens, API keys) or fake server responses. A targeted attack on a game is unlikely; the more realistic risk is opportunistic interception of traffic on compromised networks.

UnityTLS takes root certificates from the operating system and validates the chain itself using the intermediates the server presents. It cannot check revocation status. On platforms where UnityTLS validates the chain itself (macOS, Linux, Android and others), a platform that only blocks the compromised intermediates does not protect Unity applications, but a platform that removes the root certificate that signed them does. On Windows, UnityTLS hands the chain to the operating system, which applies Microsoft’s disallowed certificate list.

There is no evidence that this has been exploited against Unity applications.

Affected Platforms

Unity Editor Version Table

Applications built with the listed versions of the Unity Editor before the patched version are considered vulnerable on the affected platforms. Patched releases are in progress for Unity 6000.0 and later. This table will be updated as each patched version is released.Last updated: October 28, 2026.

Other Unity Products

Discovery

This issue comes from a public compromise of the eMudhra certificate authority, disclosed on October 20, 2026. Unity’s Security and Engineering teams assessed how UnityTLS handles the affected certificates and built a fix.

Remediation Steps

Players

Keep your device’s operating system up to date. Platforms that have removed the affected root certificate protect Unity applications without any change to the application.

Developers

Update to the patched Editor version for your release line for all projects in active development. Rebuilding shipped applications is not generally required. For platforms not listed above, follow your platform provider’s guidance.

If you cannot update yet

You can add custom certificate handlers to UnityWebRequest and the .NET networking APIs that reject the compromised certificates, but every networking call must be covered, which is usually more work than updating. Review what your application sends over the network; if API keys or similar secrets are included, consider revoking and renewing them.

Unity Fixed Versions

Direct links to the first fixed versions of the Unity Editor (which include the Unity Runtime).
Links will be added here as each patched version is released.Last updated: October 28, 2026.