Microsoft has released an urgent mitigation for a newly disclosed BitLocker bypass vulnerability known as YellowKey, tracked as CVE-2026-45585, after proof-of-concept exploit code was publicly released online.

The flaw impacts modern versions of Windows 11 and Windows Server 2025 and raises significant concerns for enterprises relying on BitLocker as a primary line of defense for endpoint encryption.

Security researchers warn that the vulnerability could allow attackers with physical access to bypass BitLocker protections and gain direct access to encrypted data without needing credentials, malware installation, or network connectivity.

What Is YellowKey?

YellowKey is a BitLocker bypass technique that abuses the Windows Recovery Environment (WinRE) during the pre-boot phase of the operating system.

The attack reportedly works by placing specially crafted FsTx files onto a USB device or EFI partition. When the target system reboots into WinRE, the attacker can trigger an unrestricted command shell during recovery operations, effectively bypassing BitLocker’s trust assumptions.

Once successful, the attacker gains direct access to the encrypted volume.

The vulnerability specifically targets systems configured with TPM-only BitLocker protection, a configuration still commonly deployed across enterprise fleets because of its transparent user experience.

Affected Systems

Microsoft confirmed that the following platforms are affected:

• Windows 11 version 24H2 (x64)
• Windows 11 version 25H2 (x64)
• Windows 11 version 26H1 (x64)
• Windows Server 2025
• Windows Server 2025 Server Core installations

The issue primarily affects devices where:

• BitLocker is enabled
• TPM-only startup authentication is configured
• Physical access to the device is possible

Why This Vulnerability Matters

Although YellowKey requires physical access, security experts stress that the real-world impact could still be severe.

Modern organizations increasingly depend on BitLocker to protect:

• Corporate laptops
• Executive devices
• Shared workstations
• Remote employee systems
• Servers stored in branch offices or datacenters

In many organizations, stolen laptops are considered low-risk specifically because full disk encryption is assumed to protect sensitive information. YellowKey challenges that assumption.

The attack is particularly concerning because it:

• Requires no credentials
• Does not depend on malware
• Leaves minimal forensic traces
• Can be executed offline
• Bypasses encryption trust during recovery operations

This makes the vulnerability highly attractive for:

• Insider threats
• Device theft scenarios
• Border inspections
• Espionage operations
• Supply chain attacks involving temporary physical access

Technical Overview of the Exploit

Researchers explain that YellowKey abuses the interaction between:

• Windows Recovery Environment (WinRE)
• Transactional NTFS recovery operations
• The autofstx.exe utility
• Pre-boot recovery trust assumptions

By manipulating recovery behavior, attackers can spawn a privileged shell before BitLocker protections are properly enforced.

The exploit effectively turns a trusted recovery mechanism into an unintended attack surface.

Microsoft’s Recommended Mitigation

Microsoft has not yet released a traditional security patch. Instead, it published mitigation guidance designed to reduce exposure.

Administrators are advised to modify the WinRE image and disable automatic execution of the FsTx recovery utility.

The mitigation process includes:

1. Mounting the WinRE image
2. Loading the registry hive
3. Removing autofstx.exe from the BootExecute registry value
4. Saving and unloading the registry
5. Rebuilding the WinRE image
6. Re-establishing BitLocker trust

This prevents the vulnerable recovery behavior from automatically executing during WinRE startup.

Strong Recommendation: Move from TPM-Only to TPM+PIN

Microsoft additionally recommends organizations transition from:

• TPM-only
  to
• TPM + PIN

With TPM+PIN enabled, the drive cannot be decrypted automatically at boot without user interaction.

This significantly reduces the effectiveness of YellowKey-style attacks because possession of the device alone is no longer sufficient.

Administrators can enforce this configuration through:

• Group Policy
• Microsoft Intune
• PowerShell
• Control Panel settings

For organizations handling highly sensitive data, TPM+PIN should now be considered a security baseline rather than an optional enhancement.

Enterprise Security Implications

YellowKey highlights a broader cybersecurity reality:

Full disk encryption alone is not a complete defense strategy.

Organizations must also secure:

• Pre-boot environments
• Recovery workflows
• Physical access controls
• BIOS/UEFI protections
• USB boot restrictions
• Secure Boot configurations

CISOs should immediately evaluate:

• Which endpoints still use TPM-only BitLocker
• Whether WinRE is hardened
• If external boot devices are restricted
• How quickly stolen devices can be remotely disabled
• Whether high-risk users require stronger pre-boot authentication

Detection and Defensive Monitoring

Because the attack operates primarily offline, detection opportunities are limited. However, defenders should still monitor for:

• Unexpected WinRE modifications
• Unauthorized recovery environment changes
• BitLocker protector configuration changes
• Suspicious USB boot activity
• Devices rebooting into recovery mode unexpectedly

Microsoft Defender for Endpoint, SIEM platforms, and endpoint hardening policies should all be reviewed in light of this disclosure.

Strategic Takeaway for CISOs

YellowKey is another reminder that attackers continue targeting trust relationships inside operating systems rather than attacking encryption directly.

The vulnerability does not “break” BitLocker cryptography. Instead, it bypasses the operational trust assumptions surrounding system recovery and startup authentication.

For enterprises, the key lesson is clear:

• Physical security still matters
• Recovery environments are high-value attack surfaces
• TPM-only protection may no longer be sufficient for sensitive environments
• Layered defense remains essential

Organizations should prioritize mitigation immediately, especially for executive laptops, privileged administrator systems, and devices containing regulated or confidential data.