Microsoft has unveiled a serious security vulnerability within Windows BitLocker, identified as CVE-2026-45585. This flaw allows individuals with physical access to circumvent full-disk encryption, potentially unveiling sensitive data in mere minutes.
Details of the Security Vulnerability
Disclosed on May 19, 2026, the vulnerability has yet to be exploited in active attacks. However, Microsoft has deemed it as “Exploitation More Likely,” urging immediate mitigation efforts. The flaw is categorized as a Security Feature Bypass with a high severity rating of Important.
The issue is located in the Windows Recovery Environment (WinRE) and involves an exploit chain known as YellowKey, which was developed by researcher Nightmare-Eclipse and made available on GitHub. Successful exploitation can bypass BitLocker Device Encryption, allowing unauthorized access to encrypted data without needing user credentials or decryption keys.
Affected Systems and Mitigation Guidance
This vulnerability affects Windows 11, Windows Server 2022, and Windows Server 2025. While a formal patch is pending, Microsoft has released a detailed manual mitigation guide to address the issue temporarily.
The vulnerability stems from WinRE’s handling of the BootExecute registry value within HKLMControlSet001ControlSession Manager. The execution of a malicious binary, autofstx.exe, is triggered before the operating system fully loads, effectively bypassing BitLocker’s pre-boot authentication.
Microsoft has outlined a six-step procedure for mitigating this issue, focusing on directly modifying the WinRE image. This includes mounting the image, altering the registry values, and re-establishing BitLocker trust.
Recommendations for Enhanced Security
Aside from addressing the WinRE flaw, Microsoft advises upgrading BitLocker protection from TPM-only to TPM+PIN configurations. This can be achieved using PowerShell, Command Prompt, or through the Control Panel under BitLocker Drive Encryption.
Administrators are encouraged to enable “Require additional authentication at startup” in Group Policy if PIN configuration is blocked. Both Microsoft Intune and Group Policy-based deployments support enforcing these configurations on a broader scale.
Given the increased risk of physical access attacks, especially on lost or stolen enterprise laptops, prioritizing these mitigation steps is crucial. The availability of the YellowKey exploit code further underscores the importance of immediate action to protect against potential threats.
Organizations managing affected Windows deployments should implement these remediation measures promptly and consider enforcing TPM+PIN policies across their systems, in anticipation of an official patch.
Stay updated by following us on Google News, LinkedIn, and X for more real-time updates.
