Microsoft Releases Mitigation for Windows BitLocker Security Bypass 0-Day Vulnerability

Microsoft has disclosed a critical zero-day vulnerability in Windows BitLocker, tracked as CVE-2026-45585, that allows threat actors with physical access to bypass full-disk encryption entirely, potentially exposing sensitive data within minutes.

The flaw was publicly disclosed on May 19, 2026, and while no active exploitation has been confirmed, Microsoft rates it as “Exploitation More Likely,” prompting urgent mitigation action.

The vulnerability is classified as a Security Feature Bypass with a maximum severity rating of Important.

It resides within the Windows Recovery Environment (WinRE) and is tied to a critical exploit chain dubbed YellowKey, developed by researcher Nightmare-Eclipse and published on GitHub.

A successful attacker can exploit this flaw to circumvent BitLocker Device Encryption on the system storage device, gaining unauthorized access to encrypted data without requiring user credentials or decryption keys.

The vulnerability exclusively impacts Windows 11, Windows Server 2022, and Windows Server 2025.

No patch has been released yet; Microsoft has instead issued a multi-step manual mitigation guide while a formal security update is prepared.

Windows BitLocker Security Bypass

The vulnerability originates in WinRE’s handling of the BootExecute registry value under HKLM\ControlSet001\Control\Session Manager.

A malicious binary — autofstx.exe — is injected into this value, executing before the operating system fully loads and bypassing BitLocker’s pre-boot authentication entirely.

Because WinRE operates outside the primary OS environment, conventional endpoint security tools cannot intercept this execution.

Microsoft’s Mitigation Steps

Microsoft has provided a six-step mitigation procedure targeting the WinRE image directly:

1. Mount the WinRE image using reagentc /mountre /path C:\mount
2. Load the WinRE system registry hive via reg load HKLM\WinREHive
3. Remove the autofstx.exe entry from BootExecute in the mounted hive
4. Unload the registry hive with reg unload HKLM\WinREHive
5. Unmount and commit the modified image using reagentc /unmountre /path C:\mount /commit
6. Re-establish BitLocker trust by running reagentc /disable followed by reagentc /enable

Beyond patching WinRE, Microsoft strongly recommends upgrading from a TPM-only BitLocker protector to a TPM+PIN configuration.

Administrators can implement this via PowerShell (Add-BitLockerKeyProtector C: -TpmAndPinProtector), Command Prompt (manage-bde -protectors -add C: -TPMAndPIN), or the Control Panel under BitLocker Drive Encryption.

If Group Policy blocks PIN configuration, administrators must first enable “Require additional authentication at startup” via gpedit.msc and set Configure TPM startup PIN to “Require startup PIN with TPM” before proceeding.

For unmanaged devices, Microsoft Intune and Group Policy-based BitLocker deployment both support enforcing TPM+PIN configurations at scale.

Physical access attacks against encrypted endpoints represent a growing threat vector, particularly for lost or stolen enterprise laptops.

The public availability of the YellowKey exploit code significantly lowers the barrier for adversaries, making it accessible even to less sophisticated threat actors.

Security teams managing Windows 11 or Server 2022/2025 deployments should prioritize the WinRE remediation steps and enforce TPM+PIN policies immediately, ahead of an official patch release.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates.