Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit

# YellowKey: Critical BitLocker Bypass Exposes Windows 11 Encryption Weakness

## The Threat

Microsoft has released emergency mitigations for CVE-2026-45585, a critical security feature bypass vulnerability in BitLocker that allows attackers with physical access to completely circumvent disk encryption on Windows 11 and Windows Server 2025. The vulnerability, publicly disclosed last week under the name "YellowKey" by researcher Chaotic Eclipse, achieves something many security teams consider impossible: breaking BitLocker protection without brute-forcing encryption keys or exploiting the operating system itself.

The attack exploits a flaw in the Windows Recovery Environment (WinRE) startup sequence. An attacker can craft malicious 'FsTx' (Transactional NTFS) files, place them on a USB drive or EFI partition, and boot the target system into WinRE. By pressing CTRL during the recovery boot sequence, they trigger a shell with unrestricted access to the BitLocker-protected volume—bypassing encryption entirely. The attack requires physical access to the machine, but takes only minutes to execute and requires no advanced technical knowledge beyond following documented steps.

The timing is particularly damaging. BitLocker represents one of the foundational security controls for enterprise endpoints, especially in remote work environments where laptops frequently travel outside the perimeter. Organizations that invested in BitLocker as their primary defense against data theft from lost or stolen devices now face the sobering reality that this protection can be trivially bypassed with a USB stick and 10 minutes of physical access. The public disclosure of a proof-of-concept means threat actors and opportunistic thieves have a turnkey exploit available immediately.

## Severity and Impact

| Attribute | Details |

|---|---|

| CVE ID | CVE-2026-45585 |

| CVSS Score | 6.8 (Medium-High) |

| CVSS Vector | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |

| Attack Vector | Physical (requires direct device access) |

| Attack Complexity | Low (straightforward exploitation process) |

| Privileges Required | None |

| User Interaction | None |

| Confidentiality Impact | High (full access to encrypted data) |

| Integrity Impact | High (ability to modify encrypted data) |

| Availability Impact | High (potential for data destruction) |

---

## Affected Products

---

## Mitigations

### Immediate Actions (Before Patch)

Option 1: Modify WinRE Configuration (Most Effective)

Organizations can immediately reduce risk by disabling the vulnerable FsTx Auto Recovery Utility in WinRE:

1. Mount the WinRE image on affected devices

2. Mount the system registry hive from the WinRE image

3. Locate and remove the "autofstx.exe" value from the Session Manager's BootExecute REG_MULTI_SZ registry entry

4. Save and unload the registry hive

5. Unmount and commit the updated WinRE image

6. Reestablish BitLocker trust for WinRE

This prevents the Transactional NTFS replay mechanism from executing when WinRE launches, eliminating the attack surface.

Option 2: Upgrade BitLocker Authentication (Recommended for All Systems)

Switch BitLocker-protected devices from "TPM-only" protector to "TPM+PIN" mode:

TPM+PIN requires users to enter a PIN at startup, which prevents the YellowKey attack from silently executing. This adds friction to legitimate boot scenarios but provides a complete mitigation.

### For Unencrypted Systems

Administrators deploying BitLocker on previously unencrypted devices should:

### Long-Term Controls

---

## References

---

## HackWire Analysis

YellowKey exposes a dangerous assumption that has dominated enterprise security thinking for a decade: that full-disk encryption is a complete solution to laptop theft. It isn't. The vulnerability reveals that BitLocker's security model relies on trusting the WinRE recovery environment—a component many organizations have never audited and few even know how to properly secure.

This attack pattern mirrors a broader trend in endpoint security: defenders are increasingly vulnerable to physical or firmware-level attacks that bypass operating system protections. From UEFI rootkits to TPM bypass techniques, the assumption that "if the OS is locked, the data is safe" is proving dangerously naive. YellowKey is particularly insidious because it requires no sophisticated hardware attacks or cryptographic breakthroughs—just a USB stick and knowledge of an undocumented keyboard shortcut.

The public disclosure is the real disaster here. Microsoft's security response framework assumes coordinated disclosure gives vendors time to patch before widespread exploitation begins. YellowKey violated that compact, meaning the exploit is now public knowledge days before patches roll out. For organizations with slow patch cycles or heterogeneous Windows deployments, this creates a dangerous window where all BitLocker-protected devices are potentially vulnerable.

The mitigation strategy—adding TPM+PIN authentication—ironically returns us to older security practices. The shift toward passwordless authentication and simplified user experiences now collides with the reality that BitLocker-only protection can be bypassed. Enterprises will need to decide whether the user friction of mandatory PINs at startup is worth the actual security guarantee, and whether they've been relying too heavily on encryption to compensate for gaps in physical security controls.

For organizations with remote workforces and traveling laptops, this is a critical wake-up call. Lost or stolen devices are no longer protected by the encryption most organizations believed was unbreakable. Immediate action—whether WinRE hardening or TPM+PIN enforcement—is necessary before YellowKey becomes the preferred attack vector for targeted data theft operations.

— HackWire Editorial

---

## Related Coverage