Microsoft Defender Mistakenly Flags DigiCert Root Certificates as Malware

A Microsoft Defender antimalware signature update around April 30, 2026 produced a false positive (Trojan:Win32/Cerdigent.A!dha) that quarantined two legitimate DigiCert root certificates from the Windows trust store, risking widespread SSL/TLS validation and code-signing failures. The report outlines detection details (including certificate thumbprints), administrative hunting and verification commands, community reporting, and Microsoft’s corrective definition update (version .430) that restored certificates and mitigated the issue.