{"id":238673,"date":"2026-05-03T14:11:00","date_gmt":"2026-05-03T18:11:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/05\/03\/microsoft-defender-wrongly-flags-digicert-certs-as-trojanwin32-cerdigent-adha\/"},"modified":"2026-05-03T16:10:12","modified_gmt":"2026-05-03T20:10:12","slug":"microsoft-defender-wrongly-flags-digicert-certs-as-trojanwin32-cerdigent-adha","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/05\/03\/microsoft-defender-wrongly-flags-digicert-certs-as-trojanwin32-cerdigent-adha\/","title":{"rendered":"Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32\/Cerdigent.A!dha"},"content":{"rendered":"<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigentadha\/\">Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32\/Cerdigent.A!dha<\/a><\/p>\n<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigentadha\/\">https:\/\/www.bleepingcomputer.com\/news\/security\/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigentadha\/<\/a><\/p>\n<p>Publish Date: <a href=\"publish_date]\">2026-05-03 14:11:00<\/a><\/p>\n<p>Source Domain: <a href=\"www.bleepingcomputer.com\">www.bleepingcomputer.com<\/a><\/p>\n<p style=\"text-align:center\">\n<p>Microsoft Defender is detecting legitimate DigiCert root certificates as Trojan:Win32\/Cerdigent.A!dha, resulting in widespread false-positive alerts, and in some cases,\u00a0removing\u00a0certificates from Windows.<\/p>\n<p>According to cybersecurity expert Florian Roth, the issue first appeared after Microsoft added the detections to a Defender signature update on April 30th.<\/p>\n<p>Today, administrators worldwide began reporting that DigiCert root certificate entries were flagged as malware and, on affected systems, removed from the Windows trust store.<\/p>\n<p>According to a Reddit post about the false positives, the detected certificates are:<\/p>\n<ul style=\"list-style-type:square\">\n<li>0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43<\/li>\n<li>DDFB16CD4931C973A2037D3FC83A4D7D775D05E4<\/li>\n<\/ul>\n<p>On impacted systems, these certificates were removed from the AuthRoot store under this Registry key:<\/p>\n<p>HKLMSOFTWAREMicrosoftSystemCertificatesAuthRootCertificates<\/p>\n<p>These false positives have led to concern among Windows users, with some thinking their devices were infected and reinstalling the operating system to be safe.<\/p>\n<p><img decoding=\"async\" alt=\"Microsoft Defender \" trojan:win32=\"\" false=\"\" positive=\"\" height=\"400\" src=\"https:\/\/www.bleepstatic.com\/images\/news\/Microsoft\/f\/false-positives\/cerdigent-false-positive.jpg\" width=\"562\"\/><strong>Microsoft Defender &#8220;Trojan:Win32\/Cerdigent.A!dha&#8221; False Positive<\/strong><br \/>Source: Reddit<\/p>\n<p>Microsoft has reportedly fixed the detections in Security Intelligence update version <strong>1.449.430.0<\/strong>, and the most recent update is now 1.449.431.0.<\/p>\n<p>Other reports on Reddit indicate that the fix also restores previously removed certificates on affected systems.<\/p>\n<p>The new Microsoft Defender updates will automatically install, and Windows users can manually\u00a0force an update by going into <strong>Windows Security<\/strong>  <strong>Virus and threat protection<\/strong>  <strong>Protection updates<\/strong> and clicking on <strong>Check for Updates<\/strong>.<\/p>\n<h2>Possibly linked to a recent DigiCert breach<\/h2>\n<p>The false positives occur shortly after a disclosed DigiCert security incident that enabled threat actors to obtain valid code-signing certificates used to sign malware.<\/p>\n<p>&#8220;A malware incident targeted a customer support team member. Upon detection, the threat vector was contained,&#8221; explains the DigiCert incident report.<\/p>\n<p>&#8220;Our&#8230;<\/p>\n<p><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigentadha\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32\/Cerdigent.A!dha https:\/\/www.bleepingcomputer.com\/news\/security\/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigentadha\/ Publish Date: 2026-05-03 14:11:00 Source Domain:&#8230;<\/p>\n","protected":false},"author":1,"featured_media":238674,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.bleepstatic.com\/content\/hl-images\/2024\/01\/26\/microsoft-red-header.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[30,24,32],"class_list":["post-238673","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-breach","tag-cybersecurity","tag-malware"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/238673"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=238673"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/238673\/revisions"}],"predecessor-version":[{"id":238675,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/238673\/revisions\/238675"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/238674"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=238673"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=238673"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=238673"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}