Microsoft Releases Mitigation for Critical BitLocker 0-Day Vulnerability

Key Takeaways

• A critical zero-day vulnerability, CVE-2026-45585, affects Windows BitLocker.
• The flaw allows attackers with physical access to bypass full-disk encryption via the Windows Recovery Environment (WinRE).
• Windows 11, Windows Server 2022, and Windows Server 2025 are impacted.
• No official patch is available; Microsoft has released a manual mitigation guide and recommends a TPM+PIN configuration.

Microsoft has recently brought to light a severe zero-day vulnerability within its BitLocker full-disk encryption feature, identified as CVE-2026-45585. This critical flaw could enable attackers who gain physical access to a targeted device to completely bypass BitLocker, potentially exposing sensitive data stored on the system within minutes.

The vulnerability, which became publicly known on May 19, 2026, has been rated by Microsoft as “Exploitation More Likely,” despite no confirmed instances of active exploitation. This urgent assessment underscores the need for immediate mitigation efforts.

Categorized as a Security Feature Bypass, the vulnerability carries a maximum severity rating of “Important.” Its root cause lies within the Windows Recovery Environment (WinRE) and is linked to an exploit chain dubbed “YellowKey,” which researcher Nightmare-Eclipse developed and published on GitHub.

Successful exploitation of this flaw allows an adversary to circumvent BitLocker Device Encryption on the system storage, thereby gaining unauthorized access to encrypted data without needing user credentials or decryption keys. The vulnerability exclusively impacts Windows 11, Windows Server 2022, and Windows Server 2025 operating systems.

As of now, Microsoft has not released a formal patch. Instead, the company has provided a multi-step manual mitigation guide to address the issue while a permanent security update is being prepared.

Windows BitLocker Security Bypass Technical Details

The vulnerability’s origin point is WinRE’s specific handling of the BootExecute registry value, located under HKLMControlSet001ControlSession Manager. The exploit involves injecting a malicious binary, autofstx.exe, into this registry value. This allows the malicious code to execute before the operating system fully loads, effectively bypassing BitLocker’s pre-boot authentication mechanisms.

A key aspect of this attack is that WinRE operates outside the primary operating system environment. This characteristic means that conventional endpoint security tools are unable to intercept or prevent this pre-boot execution, making the attack particularly insidious.

Microsoft’s Mitigation Steps

Microsoft has detailed a six-step mitigation procedure designed to directly modify the WinRE image:

• Mount the WinRE image using the command: reagentc /mountre /path C:mount
• Load the WinRE system registry hive with: reg load HKLMWinREHive
• From the mounted hive, remove the autofstx.exe entry from the BootExecute value.
• Unload the registry hive using: reg unload HKLMWinREHive
• Unmount and commit the changes to the modified image with: reagentc /unmountre /path C:mount /commit
• Re-establish BitLocker trust by first running reagentc /disable, followed by reagentc /enable.

Beyond these immediate WinRE patching steps, Microsoft strongly advises upgrading from a TPM-only BitLocker protector to a more robust TPM+PIN configuration. This can be achieved through various methods:

• PowerShell: Add-BitLockerKeyProtector C: -TpmAndPinProtector
• Command Prompt: manage-bde -protectors -add C: -TPMAndPIN
• Control Panel: Navigate to BitLocker Drive Encryption settings.

If Group Policy settings prevent PIN configuration, administrators must first enable “Require additional authentication at startup” via gpedit.msc and set “Configure TPM startup PIN” to “Require startup PIN with TPM” before attempting to configure TPM+PIN.

For large-scale deployments, both Microsoft Intune and Group Policy-based BitLocker configurations support the enforcement of TPM+PIN policies on unmanaged devices.

Physical access attacks against encrypted endpoints represent an evolving and significant threat vector, particularly for enterprise laptops that may be lost or stolen. The public availability of the YellowKey exploit code significantly lowers the barrier for potential adversaries, making this attack accessible even to less technically sophisticated threat actors.

What You Should Do

• Immediately apply the manual WinRE remediation steps provided by Microsoft for all affected Windows 11 and Windows Server 2022/2025 deployments.
• Enforce a TPM+PIN BitLocker configuration across all endpoints where feasible, particularly for portable devices.
• Review and update Group Policy settings to allow and enforce TPM+PIN configurations if necessary.
• Monitor Microsoft’s security advisories for the official patch release and apply it promptly once available.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.