A working BitLocker bypass exploit has been publicly released, and it is already sending shockwaves through the security community. Tracked as CVE-2026-45585 and nicknamed YellowKey, this Windows 11 encryption flaw lets an attacker with brief physical access read your supposedly encrypted drive — no password, no PIN, no recovery key required. If you use BitLocker to protect sensitive data on a Windows 11 device, you need to understand exactly what has happened and what you can do about it right now.
What Is the YellowKey BitLocker Vulnerability?
YellowKey is an unpatched BitLocker zero-day that exploits a weakness inside the Windows Recovery Environment (WinRE). The attacker boots the target machine from a specially crafted USB drive, which loads a custom FsTx folder structure that manipulates WinRE’s startup sequence. Because Windows Recovery Environment runs before the main OS — and therefore before BitLocker’s full authentication layer is enforced — the exploit can extract volume data without ever prompting for a decryption credential.
The vulnerability is classified under CWE-77 (Command Injection) and carries a CVSS score of 6.8. It affects Windows 11 (all currently supported versions) as well as Windows Server 2022 and 2025. The researcher who discovered it disclosed it publicly after becoming frustrated with slow vendor response — meaning a working proof-of-concept tool has been available on GitHub for anyone to download and use. That public availability is what makes this a critical incident rather than a theoretical risk.
How the BitLocker Bypass Exploit Actually Works
Understanding the attack chain helps you appreciate why the standard advice — “just keep Windows updated” — is not enough this time, because no patch yet exists.
- Step 1 — Physical access: The attacker needs the device in their hands for only a few minutes. Stolen laptop, unattended workstation, or a device seized at a border — all are realistic attack scenarios.
- Step 2 — Boot from USB: The malicious USB drive is inserted and the machine is restarted, booting directly into the crafted WinRE environment. Most consumer laptops allow USB boot by default.
- Step 3 — FsTx folder injection: The custom FsTx folder tricks WinRE into treating the USB environment as a trusted recovery context, bypassing the prompt for a BitLocker PIN or recovery key.
- Step 4 — Drive access: The encrypted volume is mounted and its contents become readable. The attacker can copy files, exfiltrate credentials, or plant malware — all while BitLocker appears to be doing its job.
The entire process can take under ten minutes, which makes it practical in the real world. No special hardware is needed beyond an off-the-shelf USB stick.
Why This Windows 11 Encryption Flaw Is So Serious
BitLocker has been the flagship full-disk encryption tool built into Windows since Vista, and millions of professionals, businesses, and individuals rely on it as their primary defence against data theft when hardware is lost or stolen. A confirmed BitLocker zero-day of this nature undermines that entire trust model.
According to the official CVE-2026-45585 record, Microsoft has confirmed the vulnerability and issued interim mitigation guidance while a permanent security update is developed. The CVE advisory explicitly states: “We are issuing this CVE to provide mitigation guidance that can be implemented to protect against this vulnerability until the security update is available.” In other words, there is no patch yet — only a workaround script.
The breach is particularly damaging for organisations operating under GDPR, HIPAA, or similar data-protection frameworks. Encrypted storage is a recognised technical safeguard; if that safeguard is neutralised by a publicly known exploit, regulators may treat any resulting data loss as a failure of due diligence.
Who Is at Risk From This BitLocker Vulnerability?
You are potentially exposed if any of the following apply:
- You run Windows 11 Home, Pro, or Enterprise with BitLocker (or Device Encryption) enabled.
- You run Windows Server 2022 or 2025 with BitLocker volume protection.
- Your device’s BIOS/UEFI firmware allows booting from USB without a password — which is the factory default on most consumer laptops.
- You have not yet applied Microsoft’s interim mitigation script.
- Your BitLocker configuration relies solely on TPM without a PIN (the most common default setup).
Devices running Windows 10 appear to be unaffected by this specific exploit chain, though they carry their own separate security concerns. Windows 11 users are the priority audience for this guidance.
How to Protect Yourself From the BitLocker Bypass Exploit
There are several concrete steps you can take today, before Microsoft ships a full patch. None of them require waiting.
Apply Microsoft’s Official Mitigation Script
Microsoft has published a PowerShell mitigation script that modifies WinRE’s trusted boot path to prevent the FsTx injection technique from working. Download it from your Windows Update advisory dashboard or from Microsoft’s Security Response Center. Run it with administrator privileges on every affected device. This is the single most important step.
Enable a BitLocker Pre-Boot PIN
By default, most Windows 11 devices use TPM-only BitLocker protection, which means the drive auto-unlocks at boot without a PIN. Switching to TPM + PIN mode adds an authentication step that runs before WinRE loads, significantly raising the bar for a physical attacker. To enable it:
- Open Group Policy Editor (
gpedit.msc) — available on Windows 11 Pro and above. - Navigate to Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Operating System Drives.
- Enable “Require additional authentication at startup” and set the PIN option to “Require startup PIN with TPM”.
- Run
manage-bde -protectors -add C: -TPMAndPINin an elevated Command Prompt and follow the prompts.
Disable USB Boot in BIOS/UEFI
If an attacker cannot boot from a USB drive, the exploit cannot run. Enter your device’s BIOS/UEFI firmware settings (typically by pressing F2, F10, Del, or Esc at startup) and either disable USB boot entirely or set a BIOS administrator password that is required before the boot order can be changed. This is a strong compensating control while the patch is pending.
Enable Secure Boot and Keep It Enabled
Secure Boot verifies the integrity of each component in the boot chain. While YellowKey has been demonstrated even on machines with Secure Boot active, combined with the PIN and BIOS controls above it creates a layered defence that significantly complicates the attack. Windows 11 already requires Secure Boot by default — confirm it has not been disabled on your device via System Information → System Summary → Secure Boot State.
Audit Physical Access Controls
Because this BitLocker bypass exploit requires physical access, hardening the physical environment matters. Lock unattended devices with a cable lock, enforce screen-lock policies, and ensure that company devices are never left in vehicles overnight. For travelling workers, whole-device encryption combined with the pre-boot PIN and disabled USB boot provides the strongest protection available until a patch lands.
What Microsoft Has Said — and What Still Needs to Happen
Microsoft has acknowledged CVE-2026-45585 and confirmed it is working on a permanent fix. The interim mitigation script, updated in late May 2026, replaces earlier manual steps with an automated tool that is easier to deploy at scale via Intune or Group Policy for enterprise environments. Individual users should apply it manually. Microsoft’s Security Response Center is tracking the issue and has indicated that a formal security update will arrive in a future Patch Tuesday release — though no date has been confirmed at time of writing.
The disclosure method — a disgruntled researcher dropping a working exploit on GitHub — is a reminder of why the security community’s relationship with responsible disclosure matters. Once a proof-of-concept is public, defenders have a narrowing window before opportunistic attackers begin using it routinely. Acting now, not when the patch arrives, is the right posture.
Does This Mean BitLocker Is Broken for Good?
No. The BitLocker vulnerability exposed by YellowKey is real and serious, but it is exploitable only with physical access. An attacker cannot run this exploit remotely over a network. BitLocker remains highly effective against the most common threat — bulk data theft from lost or stolen hardware — provided you add the pre-boot PIN and disable USB boot. Those two changes alone close the attack vector that YellowKey depends on.
Full-disk encryption still matters enormously. Without it, a thief who steals your laptop has instant access to every file on the drive; with BitLocker + PIN active, the same thief faces an effectively impenetrable barrier until Microsoft’s patch closes the WinRE gap entirely.
Keep Your Windows 11 Licence Current and Up to Date
Security patches are delivered through Windows Update, and a genuine, activated Windows 11 licence is what keeps that channel open. If your copy of Windows 11 is unactivated or running on an unsupported licence, you may not receive critical security updates — including whatever patch Microsoft eventually releases for CVE-2026-45585.
At Buy Now Key, you can pick up a legitimate Windows 11 Pro licence starting from €17.90 — a small investment compared to the cost of a data breach. If you need Windows 11 for home use, the Windows 11 Home licence is available from €15.60 and ensures you stay on Microsoft’s supported update track. Staying licensed means staying patched — and right now, patching quickly is everything.
For a broader overview of how the May 2026 update cycle addressed other vulnerabilities, see our earlier coverage of the Windows 11 KB5089549 update, which patched 120 vulnerabilities and included a related BitLocker recovery fix.
FAQ
Does the BitLocker bypass exploit work remotely?
No. CVE-2026-45585 (YellowKey) requires physical access to the target device. An attacker must be able to insert a USB drive and restart the machine. There is no known remote exploitation vector for this specific vulnerability, which means devices in secured, locked offices face a considerably lower risk than laptops carried by travelling workers.
Does Windows 11 Home support BitLocker with a PIN?
Windows 11 Home includes Device Encryption (a simplified form of BitLocker) but does not include the full Group Policy controls needed to enforce a pre-boot PIN. The TPM + PIN configuration described in this article requires Windows 11 Pro or higher. Upgrading to Pro is the most straightforward way to gain full BitLocker management on a Home device.
Is Windows 10 affected by this BitLocker vulnerability?
Based on current researcher and vendor reporting, the YellowKey exploit specifically targets the WinRE implementation found in Windows 11 and Windows Server 2022/2025. Windows 10 does not appear to be affected by this particular attack chain, though it carries other end-of-support security risks as it approaches its October 2025 end-of-life date.
Will applying the mitigation script break anything on my PC?
Microsoft’s official mitigation script is designed to modify WinRE’s trusted boot configuration without affecting normal Windows operation. Most users will notice no difference in day-to-day use. However, it is good practice to ensure you have a current BitLocker recovery key backed up to your Microsoft account or printed and stored securely before running any boot-level changes.
How will I know when the permanent patch is released?
Microsoft will deliver the fix through Windows Update as part of a future Patch Tuesday release. Enable automatic updates in Settings → Windows Update to receive it as soon as it becomes available. You can also monitor the Microsoft Security Response Center advisory for CVE-2026-45585 for the latest status.
Should I stop using BitLocker until this is fixed?
Absolutely not. Disabling BitLocker entirely would leave your data far more exposed than leaving it enabled with the interim mitigations applied. A device without any encryption is trivially readable by anyone who removes the drive. The correct response is to keep BitLocker active, enable the pre-boot PIN, apply the mitigation script, and disable USB boot in firmware.