AMS Security Advisory: eMudhra/emSign Certificate Incident

Update 27 Oct 2026: ams2026.108 is available for download.We recommend all users to upgrade.

Update 29 Oct 2026: for users unable to upgrade, try the repair script.

Update 30 Oct 2026: repair script updated to be compatible with Python >=3.6 i.e. from ams2020.101 onwards.

The eMudhra/emSign certificate security incident affects many software products, not just AMS. We recommend discussing it with your IT team.

The issue is resolved starting with ams2026.108. We recommend all users to upgrade.

What was affected in ams2026.107 and earlier

In AMS up to and including ams2026.107, the issue concerns downloading and installing optional packages.

If you’re running an affected version, do not

• download/install packages from the AMS package manager (SCM -> Packages, $AMSBIN/amspackages).
• download/install packages with $AMSBIN/amspython -m pip
• download/install packages with $AMSBIN/uv

What was not affected

The issue did not affect

• calculations with AMS, ADF, COSMO-RS, etc.
• included Python tools like PLAMS and ParAMS

The issue is resolved in ams2026.108

We applied the following fixes to ams2026.108, available from 27 Oct 2026:

• We updated the uv supplied with AMS and repaired the certificate information used by pip, including the copies used when creating new Python environments.
• We updated certificate packages and Python versions in AMSPackages environments. We reviewed all third-party dependencies and updated them where required. These changes remove the affected certificates from the AMS Python stack and all the packages distributed through AMSPackages.
• We updated the certificate bundle supplied with AMS, including the certificates used for automatic licence requests.

Fixing older AMS versions yourself

SCM recommends upgrading to ams2026.108. If upgrading is not practical, Linux and Windows users can use our repair script to check their installation and repair affected certificate bundles.

Use this script at your own risk. SCM does not take responsibility for its results and always recommends using the latest version of AMS. 

Linux and Windows

The script requires Python 3.6 or newer, as supplied with ams2020.101 and later. You need write access to the installation. For a shared installation, ask your administrator to perform the repairs.

1. Download and extract ams_certificate_check.py using the download link.
2. Open a terminal configured for the AMS installation you want to repair. On Windows, use the AMS command-line shell. Change to the directory containing the downloaded script.
3. Check the installation:"$AMSBIN/amspython" ams_certificate_check.py
4. Review the findings, then run repair mode: "$AMSBIN/amspython" ams_certificate_check.py --repair ; read each proposed action before approving it. Enter y to approve one action, or a to approve all remaining supported repairs.
5. Run the checker again to verify the result: "$AMSBIN/amspython" ams_certificate_check.py ; successful verification reports OK and scan complete. If findings or incomplete checks remain, send the full output to SCM support.

Restart AMS applications after repairing them. Repeat the procedure for each AMS installation you still use.

macOS

On macOS, install an updated AMS distribution rather than modifying the installed AMS application yourself. Changes inside a signed .app bundle can invalidate its signature and cause macOS to reject the application. 

Further details about the issue

Overview

This incident affects software’s ability to check that an internet connection is to the intended server. If an attacker can intercept a download connection, the affected certificates could allow them to impersonate the intended server and supply an altered download.

Python package tools

One aspect of the incident affects uv and pip, two tools for downloading and managing Python packages. AMS includes affected versions of these tools.

These tools include their own certificate information, so updating your operating system alone may not resolve the issue. Existing Python environments may also need updating separately.

Impact on AMS

AMS does not use pip or uv to run calculations. You can continue to start and run calculations, including those using packages and models already installed through AMSPackages. There is no need to stop running jobs or reinstall those packages simply to continue calculations.

The issue is relevant when AMS or its supplied tools connect to an online service, including:

• Downloading and installing environments through AMSPackages.
• Installing Python packages with amspython -m pip install.
• Creating or updating Python environments using the uv supplied with AMS.

Using an already installed package for a calculation is different from installing or updating that package: it is the download operation that is relevant to this issue. Existing Python environments can retain their own affected certificate information, so they may need updating before you use them for further downloads. Some third-party Python libraries supplied with AMS can also download models or other data over HTTPS. AMS does not use these libraries’ download features directly, so this additional concern is limited to cases where you use those features in your own Python scripts.