Microsoft PKI Services self-reported CPS annual review lapse and omission of four Issuing CAs; all remediation completed and closure requested
Microsoft PKI Services self-reported that its third-party code signing CPS missed its annual review/update deadline and that four Issuing CAs were omitted from the published document. Microsoft said it became aware of the issue on 2026-07-30 and later filed a full incident report explaining that the two omissions had separate causes: a monitoring gap for the annual review and a CA-creation workflow gap for the missing Issuing CAs. Microsoft stated that no end-entity certificate was misissued and that no revocation was required. It published CPS v1.0.6 on 2026-08-05 listing all four Issuing CAs. Microsoft later reported that all disclosed action items were completed and requested closure, and CCADB issued a final call for comments saying the incident report would be closed on or about 2026-10-05 if there were no further questions.
- Microsoft_PKI_ThirdParty_CPS v1.0.5 was last published.
- Four subordinate Issuing CAs under Microsoft ID Verified Code Signing PCA 2021 were created.
- The CPS annual review deadline passed without an updated publication.
- Microsoft published CPS v1.0.6.
- Microsoft Corporation — Microsoft filed a preliminary incident report describing the missed annual CPS republication and the omission of four Issuing CAs, and said a full incident report would follow within 14 days.
- Microsoft Corporation — Microsoft filed the full incident report, explained the separate causes for the two omissions, and said the non-compliance ended with publication of v1.0.6.
- Microsoft Corporation — Microsoft posted a weekly status update saying one remediation action item was closed and two remained open.
- Microsoft Corporation — Microsoft posted another status update saying two of the three action items were completed and one remained open.
- Microsoft Corporation — Microsoft asked for the next update date to be set to 2026-10-05 to match the due date of the remaining action item.
- Microsoft Corporation — Microsoft posted a closure summary stating that all disclosed action items were completed and requesting closure of the bug.
- CCADB representative — CCADB issued a final call for comments and said the incident report would be closed on or about 2026-10-05 if there were no further questions.