Windows BitLocker Bypass Flaw YellowKey: Fix Status and What to Do

"BitLocker," the disk encryption built into Windows, had a flaw that let an attacker with a single USB stick and a few minutes of physical access defeat it on a lost or briefly unattended PC. It is tracked as CVE-2026-45585 (nicknamed "YellowKey"). It affects Windows 11 (24H2 / 25H2 / 26H1) and Windows Server 2025, and Microsoft fixed it in the June 10, 2026 monthly update. If Windows Update on your machine is current up to that update or later, no further action is needed for this flaw. Devices set to "TPM + PIN" (a PIN required at boot) were never exploitable to begin with.

The stage is the Windows "Recovery Environment (WinRE)." With a single USB stick and physical access, an attacker could boot the PC into WinRE through a crafted path, slip past the administrator check that should be required, and bypass BitLocker encryption and the password set in UEFI/BIOS. A proof-of-concept (PoC) is public; in Japan, JVN (JVNVU#90386605) issued an advisory, and the U.S. CERT/CC tracks it as VU#226679. Microsoft rates it CVSS 6.8, but it was serious because it broke the assumption that "encrypted means safe."

As of July 23, 2026 — about two months after disclosure — the flaw is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and Microsoft has not confirmed exploitation in the wild. Meanwhile, the July 14, 2026 monthly update fixed another BitLocker bypass, CVE-2026-50661 (covered below). So rather than patching YellowKey and stopping there, keeping Windows Update current every month is the real fix.

Who is at risk, and what is the damage

This flaw hits an attacker who gets a lost or stolen laptop, or who can touch the device during the few minutes its owner steps away. In security, the trick of quietly operating a device while the owner is absent is called an "Evil Maid" attack. It is not "anyone over the network" — physical access to the device is the prerequisite.

From there, the attacker boots the device from a USB stick into the recovery environment and reads the contents of the encrypted disk, and settings protected by a BIOS password, without impersonating the owner. In the researcher's demonstration, all it took was one USB stick, and the key was reconstructed to unlock the disk within minutes.

The real harm is that "we encrypted it, so we're fine" no longer holds. A lost corporate device used to be filed as "contents protected by BitLocker → limited impact." If this flaw succeeds, a single lost or stolen machine can give up stored customer data, design files, and even saved logins to internal systems. For individuals, it means the photos, documents, and passwords on a stolen laptop are at risk even through encryption. That is why the update and settings review below matter.

Attacks aimed at this "boot-time entrance" have grown lately. We have also covered a flaw that bypasses Secure Boot (the mechanism that only lets a genuine OS start). The very first thing a PC runs is both the foundation of its defenses and an attractive way in for attackers.

What is happening, technically

The key is the Windows Recovery Environment (WinRE), a special boot mode for repairing a Windows that won't start, which comes up through a different path than normal Windows. Per CERT/CC's VU#226679, that alternate boot path into WinRE does not consistently apply the UEFI/BIOS security checks that hold during a normal OS boot, and because the "BootNext" variable that directs boot order is not authenticated, the firmware password can be slipped past.

The BitLocker bypass extends from this. In the published technique, the device is forced into WinRE via a crafted boot option, a missing access-control check is abused to open a command prompt, and the values held by the "TPM" security chip (the PCRs) are read to reconstruct the disk encryption key. A variant that hides in the early-running "BootExecute" mechanism has also been reported. The whole sequence reportedly completes in under two minutes, and the only tool needed is a USB stick.

This is not purely a Windows matter; it also involves how the PC's firmware (UEFI/BIOS) is built. In CERT/CC's coordination, AMI, Insyde, Intel, and Supermicro are listed as fixed or not affected, while GIGABYTE is affected and reportedly judged it a "design trade-off." So after applying the Windows update, it is safest to also check your model's firmware-side status.

Confirmed vs. things to note

What came after: July 2026 fixed another BitLocker bypass

The story did not end with YellowKey. The July 14, 2026 monthly update (roughly 570 fixes) closed another flaw that can bypass BitLocker's protection.

CVE-2026-50661: another BitLocker bypass whose technique was already public

CVE-2026-50661 is classified as a Security Feature Bypass, rated CVSS 6.1, and — like YellowKey — requires physical access to the device. It was treated as a publicly disclosed zero-day at patch time, but no exploitation has been reported, and it is not in the KEV catalog as of July 23, 2026. Rapid7 and Tenable note it may correspond to a technique dubbed "GreatXML," published by the same researcher who disclosed YellowKey (Chaotic Eclipse / Nightmare Eclipse).

BitLocker and WinRE are under heavy scrutiny from researchers right now, and more flaws of this kind may surface. Rather than chasing individual CVE numbers, applying the monthly updates every month is the reliable habit.

What to do

The top priority is to bring Windows Update current to the latest monthly update. YellowKey (CVE-2026-45585) was closed by the June 10, 2026 update, and the follow-up CVE-2026-50661 by the July 14, 2026 update. Using Microsoft's update guide (CVE-2026-45585) as a reference, move any device that stopped at the June update forward to the July one. At that point, both flaws covered in this article are closed.

On top of that, settings that strengthen encryption help. Setting BitLocker to "TPM + PIN" (requiring a PIN at boot) means that even if a similar technique appears, an attacker who doesn't know the PIN can't get the key. The interim mitigations Microsoft suggested on May 20, 2026 — temporarily disabling the recovery environment (reagentc /disable from an elevated prompt), requiring administrator authentication at boot, and restricting booting from USB media or the EFI System Partition — are no longer needed once the fix is applied. In particular, if WinRE was left disabled, normal repair features stay unavailable, so check for anything left un-reverted. If you manage many devices, review the monthly updates' rollout status and revise your lost/stolen-device procedures so they no longer assume "encrypted means safe." Finally, basic device handling — reducing physical carry-off and unattended exposure — reliably blunts this class of attack.

Summary

CVE-2026-45585 (YellowKey) abused the Windows recovery environment WinRE to defeat BitLocker disk encryption and the UEFI/BIOS password in minutes, with physical access and a single USB stick. It affects Windows 11 (24H2 / 25H2 / 26H1) and Windows Server 2025, and Microsoft fixed it in the June 10, 2026 monthly update. As of July 23, 2026 — about two months after disclosure — there is no KEV listing and no confirmed exploitation. If your Windows Update is current up to that update or later, no further action is needed.

That said, the July 2026 monthly update fixed yet another BitLocker bypass (CVE-2026-50661), and researchers keep probing this area. Combine a monthly-patching habit with moving BitLocker to TPM + PIN and tightening physical device management. Protecting "the very first thing a PC runs" is what makes encryption truly meaningful.

References

• ・JVN — JVNVU#90386605 (WinRE bypass of UEFI/BIOS password)
• ・CERT/CC — VU#226679
• ・Microsoft MSRC — CVE-2026-45585
• ・Help Net Security — YellowKey mitigation
• ・SecurityWeek — Microsoft rolls out mitigations for YellowKey
• ・BleepingComputer — July 2026 Patch Tuesday (about 570 fixes)
• ・Rapid7 — Patch Tuesday July 2026 (CVE-2026-50661)
• ・BleepingComputer — BitLocker zero-day, PoC released
• ・Related: Secure Boot bypass flaw (this site)