A Windows zero-day called YellowKey is giving attackers a way to bypass BitLocker and access the contents of encrypted drives. Microsoft assigned it CVE-2026-45585, rated it Important, and has published mitigation steps while a permanent patch is in development.
No security update is available yet. Until one lands, you need to apply the mitigations manually. This guide explains what YellowKey does, who is at risk, and exactly what to do to protect your Windows 11 device right now.
What Is the YellowKey BitLocker Vulnerability?
YellowKey is a security feature bypass vulnerability. It does not break BitLocker’s encryption directly, but it lets an attacker with physical access to your machine reach the encrypted data anyway by abusing Windows Recovery Environment (WinRE).
A security researcher known as Nightmare Eclipse disclosed the vulnerability publicly last week and released a working proof-of-concept (PoC) exploit, bypassing the coordinated disclosure process Microsoft typically expects. That public release is what pushed Microsoft to act immediately with mitigation guidance rather than waiting for a scheduled Patch Tuesday fix.
This is not the first time Nightmare Eclipse has released Windows exploits without waiting for Microsoft. The same researcher previously disclosed BlueHammer (CVE-2026-33825), RedSun, GreenPlasma, and UnDefend, several of which are already being actively exploited in attacks. YellowKey follows the same pattern: a working PoC is now publicly available, which means exploitation is a matter of when, not if.
This is a separate issue from the BitLocker vulnerability CVE-2026-27913 that targeted Secure Boot, though both fall under the same category of BitLocker security feature bypasses. If your device is not yet patched for that one, address both together.
YellowKey Vulnerability Severity and CVE Details
| Detail | Value |
|---|---|
| CVE ID | CVE-2026-45585 |
| Severity | Important |
| CVSS Score | 6.8 (Base) / 6.3 (Temporal) |
| Attack Vector | Physical |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Publicly Disclosed | Yes |
| Exploited in the Wild | No (as of May 20, 2026) |
| Exploitability Assessment | Exploitation More Likely |
| Weakness | CWE-77: Command Injection |
The physical attack vector is the key detail here. An attacker cannot exploit YellowKey remotely. They must have hands-on access to the target machine. For corporate laptops, shared workstations, and devices that travel, that is a realistic threat. For a home desktop that never leaves the house, the risk is lower, but the mitigations are still worth applying.
How the YellowKey Attack Works
The exploit uses specially crafted FsTx files placed on either a USB drive or the EFI partition of the target device. Here is the attack chain:
- The attacker places the crafted FsTx files on a USB drive or the device’s EFI partition.
- The device reboots into Windows Recovery Environment (WinRE).
- WinRE automatically runs
autofstx.exe, the FsTx Auto Recovery Utility, as part of theBootExecuteprocess in Session Manager. - The
autofstx.exeprocess deleteswinpeshl.iniinside WinRE, a file that controls which shell launches. - With
winpeshl.iniremoved, WinRE falls back to an uncontrolled shell. - The attacker holds CTRL during the process to trigger the shell.
- That shell runs with unrestricted access to the BitLocker-protected storage volume.
The entire mechanism hinges on autofstx.exe running automatically inside WinRE. The mitigations Microsoft recommends are designed to break that chain before it completes.
Who Is at Risk?
Any Windows 11 device that meets all three conditions below is potentially vulnerable:
- BitLocker is enabled using TPM-only mode (no startup PIN).
- The device has a WinRE image present and enabled.
- An attacker can gain physical access to the machine.
Devices already configured with TPM+PIN mode are not exploitable through this attack, because the attacker cannot decrypt the drive even after reaching the shell.
If your organization manages laptops used by employees who work remotely, travel, or share office spaces, apply the mitigations immediately. Do not wait for the patch.
How to Fix the YellowKey Vulnerability
Microsoft recommends two independent lines of defense. Apply both.
Fix 1: Remove autofstx.exe from WinRE BootExecute
This breaks the attack chain by preventing autofstx.exe from running automatically when WinRE launches. Run all commands from an elevated command prompt (Run as administrator).
Step 1: Mount the WinRE image
mkdir C:\mount
reagentc /mountre /path C:\mountStep 2: Load the WinRE system registry hive
reg load HKLM\WinREHive C:\mount\Windows\System32\config\SYSTEMStep 3: Remove the autofstx.exe entry from BootExecute
Open Registry Editor (regedit) and navigate to:
HKLM\WinREHive\ControlSet001\Control\Session ManagerFind the BootExecute value (type: REG_MULTI_SZ) and remove the autofstx.exe line from it. Leave all other entries untouched.
Step 4: Save and unload the registry hive
reg unload HKLM\WinREHiveStep 5: Unmount and commit the updated WinRE image
reagentc /unmountre /path C:\mount /commitStep 6: Reestablish BitLocker trust for WinRE
reagentc /disable
reagentc /enableThis last step is critical. It ensures BitLocker re-establishes its trust relationship with the updated WinRE image.
Fix 2: Add a PIN to BitLocker (TPM+PIN Mode)
Switching from TPM-only to TPM+PIN mode requires an attacker to enter a PIN at startup before Windows decrypts the drive. Even if they reach an unrestricted shell via the YellowKey method, the drive remains locked without the PIN.
For devices already encrypted with BitLocker
If you see the error “Group policy settings do not permit the use of a PIN at startup” when attempting any of the methods below, run this first in gpedit.msc:
Navigate to:
Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System DrivesDouble-click Require additional authentication at startup, set it to Enabled, then set Configure TPM startup PIN to Require startup PIN with TPM. Click Apply, then OK.
Method 1: PowerShell
Add-BitLockerKeyProtector C: -TpmAndPinProtectorEnter the PIN when prompted, then confirm it.
Method 2: Command Prompt
manage-bde -protectors -add C: -TPMAndPINEnter and confirm your PIN.
Method 3: Control Panel
- Open Control Panel.
- Go to BitLocker Drive Encryption.
- Under Operating System Drive, click Change how drive is unlocked at startup.
- Click Enter a PIN (recommended).
- Enter your PIN, confirm it, and click Set PIN.
For devices not yet encrypted
Using Microsoft Intune:
- Open the Microsoft Intune admin center.
- Go to Endpoint security > Disk encryption > Create policy.
- Select Windows 10 and later as the platform and BitLocker as the profile.
- Under BitLocker OS drive settings, set Require additional authentication at startup to Enabled.
- Set Configure TPM startup PIN to Require startup PIN with TPM.
- Assign the policy to your target device group and save.
Using Group Policies:
- Run
gpupdate /forcein an elevated command prompt to apply the policy immediately. - Press Win + R, type
gpedit.msc, and press Enter. - Navigate to:
Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives - Double-click Require additional authentication at startup and set it to Enabled.
- Set Configure TPM startup PIN to Require startup PIN with TPM.
- Click Apply, then OK.
When Will Microsoft Release a CVE-2026-45585 Patch?
Microsoft has not released a security update for CVE-2026-45585 yet. The advisory says a patch is coming, but no release date is confirmed. Watch for it in an upcoming Patch Tuesday or out-of-band update, similar to how Microsoft handled the emergency fixes after April Patch Tuesday broke Windows Server.
Once a security update is available, install it even if you have already applied the mitigations above. The mitigations reduce risk but a proper patch is the complete fix.
While you wait, make sure your BitLocker recovery key is accessible in your Microsoft account, because enabling TPM+PIN mode changes your boot environment and may trigger a BitLocker recovery prompt on the next restart. If Windows asks for the key, you will need it to complete the boot.
Adding a startup PIN also changes how BitLocker interacts with your TPM. If you see the BitLocker recovery key prompt on every boot after applying these mitigations, that article walks through the fix.
Frequently Asked Questions
Does the YellowKey exploit work remotely?
No. CVE-2026-45585 requires physical access to the target device. An attacker cannot exploit it remotely over a network.
Is my device safe if BitLocker uses TPM+PIN mode?
Yes. The attack only works against TPM-only configurations. Devices already using a startup PIN are not vulnerable.
Has Microsoft released a patch for CVE-2026-45585?
Not yet. Microsoft confirmed a security update is in development but has not shared a release date. Apply the manual mitigations now and install the patch once it becomes available.
Will adding a BitLocker startup PIN affect my daily Windows usage?
Only at boot. You enter the PIN once before Windows loads. Everything after login works exactly as before.
What should I do if Windows asks for a BitLocker recovery key after applying the mitigations?
That is expected behavior when your boot environment changes. Make sure your recovery key is saved to your Microsoft account or a safe location before you apply the mitigations so you can enter it if prompted.
What is autofstx.exe?
It is the FsTx Auto Recovery Utility, a component that runs automatically inside WinRE during the BootExecute phase. YellowKey abuses this utility to delete winpeshl.ini and gain an unrestricted shell. Removing it from BootExecute in the WinRE image blocks the attack.
