Microsoft quietly fixed a critical BitLocker encryption bypass vulnerability—tracked as CVE-2026-45585 and nicknamed YellowKey—in its June 2026 Patch Tuesday updates. The patch closes a physical-access attack that could allow a determined actor with hands-on access to a Windows PC to sidestep BitLocker protections and read encrypted files.

While the flaw required an attacker to have physical possession of the device, it undercut one of BitLocker’s core promises: that a powered-off, encrypted drive reveals nothing without the key. With the fix now available through Windows Update, the immediate danger is over—but the episode is a sharp reminder that default encryption settings are not a magic shield against all real-world threats.

What Was YellowKey, and How Did It Let Attackers In?

YellowKey exploited the Windows Recovery Environment (WinRE), a lightweight version of Windows that launches when operating system repair or recovery tools are needed. The attack chain, as documented by security researchers, worked like this:

  1. An attacker boots the target PC from a prepared USB drive that contains a specially crafted WinRE image.
  2. Once inside the recovery environment, the attacker runs a tool that leverages the system’s own diagnostic capabilities to access the encrypted disk’s contents without ever providing a BitLocker password or recovery key.
  3. Because the TPM measures the boot process, it assumes the machine is in a trusted state and releases the disk-unlocking keys automatically—as designed—except that the “trusted” state has been faked.

The bypass did not break the AES-128 encryption BitLocker uses. Instead, it attacked the chain of trust that BitLocker relies on. Systems that required a pre-boot PIN or a USB startup key (often called “TPM+PIN” or “TPM+Key”) were not directly vulnerable to this method because an attacker would also need that additional secret. But millions of Windows devices ship with TPM-only protection, where the disk unlocks silently as soon as the hardware checks pass. That’s the default for most consumer laptops, and it was the exact scenario YellowKey targeted.

The June 2026 Fix: What Actually Changed

On June 9, 2026, Microsoft released its monthly security rollup as part of Patch Tuesday. Buried in the long list of patches was an update for CVE-2026-45585. According to Microsoft’s advisory, the update corrects how WinRE validates the boot environment, closing the loophole that allowed an attacker to trick the TPM into releasing the encryption key.

The patch works, but it comes with a catch: installing the cumulative update alone may not secure the recovery environment if the WinRE image on your system hasn’t been refreshed in a while. Windows uses a separate servicing mechanism for the recovery tools partition, and it doesn’t always get updated alongside the main operating system. To ensure you’re fully protected:

  • Open Settings → Windows Update and install all available updates, including optional ones.
  • Run the following command in an elevated Command Prompt to check whether the recovery environment is up to date:
    reagentc /info
  • If the “Windows RE status” shows anything other than “Enabled” and the path points to the recovery partition, you may need to use the Deployment Image Servicing and Management (DISM) tool to slipstream the latest updates onto the WinRE image. A complete guide is available in Microsoft’s documentation for servicing the recovery environment.
  • After updating, verify your BitLocker status by opening Control Panel → BitLocker Drive Encryption and confirming that encryption is active and that you have your recovery key backed up.

Enterprise administrators can deploy the fix through Windows Server Update Services (WSUS) or Microsoft Endpoint Configuration Manager, but they should pay special attention to the WinRE servicing step—many managed devices may have stale recovery images that need a separate injection of the patch.

Who Is Affected—and Who Isn’t

The YellowKey bypass targeted Windows 11 and Windows 10 systems with BitLocker Device Encryption (the automatic, TPM-only flavor) enabled. This includes most modern laptops that ship with a TPM 2.0 chip and a Microsoft account or corporate identity. If you never changed your BitLocker settings and simply logged in with a Microsoft account on a new PC, you are likely in this category.

Systems that require a PIN at startup—the classic “insert a PIN before Windows loads” screen—are not vulnerable to the specific YellowKey attack. However, Microsoft still recommends applying the patch to protect against any future variants that might try to exploit the same flaw in a different way. Also, the patch fixes the underlying WinRE trust issue, so skipping it would leave a known weakness in the recovery path even if your primary unlock method is stronger.

Machines that use BitLocker with a USB startup key (where a flash drive must be inserted at boot) are in a similar position: not directly exposed, but still benefiting from the patch.

What This Means for Everyday Windows Users

For the typical home user, the short answer is: update Windows, and then breathe. The patch has been available for a month, and if your device is online and configured to receive updates automatically, you’re likely already protected. Still, a few simple checks can prevent a nasty surprise later.

1. Confirm the patch is installed.
Look for the June 2026 cumulative update in your update history. The exact KB number varies by Windows version, but it’s the one dated June 9, 2026. If you see it, you’re good.

2. Locate your BitLocker recovery key.
In the worst of all cases—a system that refuses to boot after a firmware change or an attack attempt—having that 48-digit key is the only way back in. For Home edition users, it’s almost certainly stored in your Microsoft account at account.microsoft.com/devices/recoverykey. Bookmark that page, sign in, and make sure your key is there. Pro users with a local account should have saved it to a USB drive or printed it out. If you can’t find it, open BitLocker Drive Encryption in Control Panel, click “Back up your recovery key,” and choose a safe location.

3. Reconsider TPM-only if your laptop holds sensitive data.
The convenience of a single power-button press to the desktop is lovely—until the device gets stolen at an airport. Suppose you regularly carry financial records, client files, or unreported journalism. In that case, switching to TPM+PIN adds an extra hurdle for a thief, and Windows makes it easy:
- Open Settings → System → About and click “BitLocker settings” (or go to Control Panel).
- Next to the encrypted drive, click “Manage BitLocker.”
- Choose “Change how drive is unlocked at startup.”
- Select “Use a PIN (recommended)” and set a numeric PIN of 8–20 digits.

The downside is that you’ll need to enter that PIN every time you start the machine. But that inconvenience might be worth it if the data on your laptop is worth more than a few seconds of your time.

4. Know BitLocker’s limits.
BitLocker is at its best when the computer is off or hibernated. It doesn’t protect files while you’re logged in and using the system—if you click a malicious attachment or someone gains remote access, BitLocker won’t stop them. For that, you still need antivirus, careful browsing habits, and maybe a dedicated encryption tool for individual files.

What IT Administrators Need to Do

In a managed environment, the patch is just the first step. The YellowKey episode underscores that the recovery environment isn’t a set-it-and-forget-it component. Here’s a checklist for admins:

  • Audit WinRE status across your fleet. Use Configuration Manager or Intune to check whether the recovery environment is present, enabled, and at the latest version. Microsoft provides a script that can inventory WinRE health via a custom compliance baseline.
  • Reprovision the recovery partition if needed. For devices that haven’t had a major Windows version upgrade in a while, the recovery image may be years old and vulnerable to multiple issues. The “REAgentC” tool can disable and re-enable WinRE after a partition resize, and DISM can apply the latest patches directly to the image.
  • Enforce TPM+PIN for executives, developers, journalists, and anyone who regularly travels with sensitive data. Group Policy has a setting at Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Operating System Drives → “Require additional authentication at startup.” You can mandate a PIN length and complexity there.
  • Test the recovery process. Don’t assume that BitLocker recovery keys are safely stored in Active Directory or Entra ID. On a handful of test machines, simulate a recovery: trigger a TPM reset or a change in boot order, and make sure the help desk can retrieve the key and unlock the device.
  • Plan for a potential second vulnerability. The same researcher who found YellowKey later reported another BitLocker bypass, this one disclosed in late June 2026. Details are scarce, but it likely also targets the recovery or boot path. Keeping WinRE fully patched now will make you better positioned when that next fix arrives.

How We Got Here: A Timeline of YellowKey

The story unfolded rapidly over the spring and summer of 2026:

  • May 2026: Independent security researchers (who would later coin the name “YellowKey”) privately disclosed the WinRE bypass to Microsoft. Proof-of-concept code showed that the attack could be performed with a standard USB drive and a few minutes of physical access.
  • Late May 2026: Microsoft acknowledged the vulnerability and issued a stopgap mitigation. The mitigation recommended disabling WinRE entirely or restricting boot from external devices, while the security team worked on a proper fix.
  • June 9, 2026: Patch Tuesday brought the official update for CVE-2026-45585. The accompanying advisory recognized the severity but noted that exploitation required physical access, which kept the maximum CVSS score below 7.0.
  • Late June 2026: The same researcher disclosed a separate BitLocker-related vulnerability, unrelated to YellowKey but also involving physical access. Microsoft has yet to comment publicly on that finding as of late July 2026.

Throughout the episode, BitLocker’s core encryption was never broken. The lesson was about the assumptions we make when we trust the entire boot chain without an additional human-in-the-loop factor.

Outlook: Staying Ahead of Physical-Access Threats

BitLocker is a mature, well-audited product that will remain the default disk encryption layer for Windows for the foreseeable future. YellowKey didn’t change that. What it did change is the conversation around how protection is configured.

For Microsoft, the incident may accelerate a long-discussed shift toward more secure defaults—perhaps prompting a setup wizard that nudges users toward a PIN during initial device setup. For users, it’s a chance to review something you probably haven’t looked at since the day you bought your PC.

The next few months will bring additional patches, both for the newly discovered bypass and for any remaining edge cases. Keep Windows Update running, keep your recovery key handy, and remember: the weakest link in any security chain is usually the one you forget to check.