Microsoft has published a security advisory and temporary mitigation guidance for a publicly disclosed BitLocker security-feature bypass identified as CVE-2026-45585, nicknamed YellowKey. The vulnerability leverages the Windows Recovery Environment (WinRE) to gain unauthorized access to BitLocker-encrypted drives when an attacker has physical access to a device.

This is not a remote exploit. An attacker must be in front of the machine, boot it into WinRE, and exploit a logic flaw to bypass BitLocker's encryption. The core issue resides in how certain Windows 11 configurations handle recovery and authentication sequencing when booting from external media or entering advanced startup options.

What Is YellowKey?

YellowKey is a security-feature bypass, not a cryptographic break. BitLocker's AES encryption remains intact; the vulnerability instead circumvents the authentication layer that normally protects the encryption key. In practice, an attacker can force a device into WinRE, manipulate the recovery process, and gain access to the volume master key without providing the correct PIN, password, or startup key.

The name YellowKey appears to stem from the attack's use of a specially crafted recovery image or scripts that manipulate the WinRE command prompt to extract BitLocker protectors from memory or disk. While Microsoft has not confirmed the technical details, multiple security researchers have demonstrated the technique on systems using TPM-only protectors without an additional PIN.

Attack Vector: Windows Recovery Environment

WinRE is a crucial troubleshooting component, but its power also makes it a high-value target. It runs outside the locked operating system and has direct access to the disk. When BitLocker uses TPM-only authentication, the encryption key is automatically unsealed during a normal boot sequence if the platform integrity checks pass. However, during recovery scenarios, some implementations fail to properly re-validate the user's authentication.

An attacker can boot from a USB recovery drive, the local recovery partition, or via network boot. By interrupting the normal start-up process — for example, by holding the Shift key and selecting Restart — they land in the advanced startup menu. From there, a series of commands can exploit the YellowKey vulnerability to obtain the master key.

Crucially, the attack does not leave obvious forensic traces on the file system because it operates in the pre-boot environment. This makes it particularly dangerous for lost or stolen devices.

Effective Mitigation: Requiring a Pre‑boot PIN

Microsoft's primary mitigation advice is clear: configure BitLocker with TPM+PIN authentication. This enhancement adds a user-supplied PIN that must be entered before Windows will unseal the volume master key. Even if an attacker boots into WinRE, they cannot decrypt the drive without the PIN.

Organizations that rely on TPM-only protectors for a seamless sign‑in experience should immediately reassess their risk model. The convenience of skipping a PIN at startup comes at the cost of vulnerability to physical attacks — a trade‑off that YellowKey exploits directly.

Additional mitigation steps include:

  • Disabling the recovery environment from the local disk and requiring a recovery USB key stored in a secure location.
  • Restricting boot order to the internal SSD only and password-protecting the UEFI firmware to prevent booting from external media.
  • Using Windows Hello Enhanced Sign‑in Security or other secondary authentication factors that integrate with BitLocker's key protectors.
  • Updating to the latest Windows 11 builds that incorporate the official Microsoft patch when it becomes available (temporary mitigation instructions were issued on Microsoft's Security Response Center page for CVE-2026-45585).

Which Systems Are Affected?

Microsoft has not released an exhaustive list, but the advisory indicates that the vulnerability impacts some Windows 11 editions and hardware configurations. The common prerequisite is that BitLocker is enabled with a TPM-only protector and that the recovery environment is accessible. Systems with TPM+PIN, TPM+USB, or TPM+Network protectors are not directly susceptible to the bypass. Devices running Windows 10 are currently believed to be unaffected, though administrators should verify with their Microsoft representative.

It is worth emphasizing that the attack requires physical possession of the device. Remote adversaries cannot trigger this vulnerability over a network. This limits the threat scope to scenarios involving theft, loss, or an untrusted insider with hands-on access.

Temporary Mitigation vs. Permanent Patch

Unlike a typical Patch Tuesday update, the fix for YellowKey involves more than replacing a driver or DLL. According to Microsoft, the root cause lies in the interaction between the operating system loader, the recovery environment, and the BitLocker filter drivers. A comprehensive code change is under development and will ship in a future cumulative update. Meanwhile, the temporary guidance — including deploying a group policy to disable WinRE's command prompt access and enforcing TPM+PIN — serves as the frontline defense.

Administrators should immediately push configuration changes via Microsoft Intune or Group Policy:

# Disable the use of recovery tools in WinRE
Reagentc.exe /disable

After applying the future patch, re-enable if necessary

Disabling WinRE entirely breaks several recovery workflows, so it is only recommended until the patch is available and thoroughly tested.

Industry Context and Historical Precedents

This is not the first time WinRE has been implicated in a BitLocker bypass. CVE-2022-41099, for example, also involved recovery environment access and prompted Microsoft to strengthen the Secure Boot chain. The recurring theme underscores the difficulty of securing a pre‑boot environment that must perform core disk operations without the full protection of the operating system.

Security researchers have long warned that TPM-only BitLocker protectors are vulnerable to cold‑boot attacks, DMA attacks, and now WinRE‑based bypasses. The UEFI forum and chipset vendors have introduced mitigations like memory encryption and TDX, but adoption is gradual. YellowKey reinforces the need for hardware‑backed security features and defense‑in‑depth that combines the TPM with a user‑provided secret.

What Should IT Administrators Do Right Now?

Time is critical. Because the vulnerability is publicly disclosed, proof-of-concept exploit code is likely already circulating. Administrators should take these immediate steps:

  1. Identify Devices at Risk – Run a Microsoft Defender for Endpoint or configuration manager query to list all devices with BitLocker enabled and TPM-only protectors.
  2. Deploy TPM+PIN – Use a GPO or MEM policy to require an enhanced BitLocker PIN. For domain-joined machines, the PIN can be configured via the manage-bde -protectors -add c: -TPMAndPIN command.
  3. Restrict Recovery Tools – Set the policy “Turn off recovery tools” under Computer Configuration\Administrative Templates\Windows Components\Windows Recovery Environment.
  4. Harden UEFI Settings – Enable UEFI Secure Boot, remove USB and network devices from the boot order, and set a strong UEFI administrator password.
  5. Monitor for Physical Tampering – Ensure that tamper‑evident seals, chassis intrusion detection, and device location tracking are active for high‑value endpoints.
  6. Review Incident Response Procedures – Update your playbooks to include the scenario of an offline BitLocker bypass. Teach support staff to recognize signs of unauthorized recovery boot attempts.

For at‑home users and small businesses without centralized management, the advice is straightforward: if your device stores sensitive data and you leave it in public spaces, enable a BitLocker startup PIN immediately. The inconvenience is minor compared to the cost of a data breach.

Long‑term Implications

YellowKey has renewed the debate about the balance between usability and security in full‑disk encryption. Microsoft’s decision to make device encryption the default on modern Windows 11 PCs — often with TPM‑only protection — prioritises a frictionless user experience. Attacks like this expose the risks of that default. In response, Microsoft may reconsider the default protector choice, perhaps prompting users to set up a PIN during the Out‑of‑Box Experience.

For enterprise customers, the incident highlights the importance of device attestation and the Zero Trust principle of “never trust, always verify.” A device’s location and physical integrity must be continuously validated. Technologies like Windows Hello for Business with multi‑factor unlock, combined with BitLocker Network Unlock, can offer both security and convenience without requiring a manual PIN every boot.

Conclusion

CVE-2026-45585 is a serious but manageable threat. It matters most for organisations that have assumed TPM‑only BitLocker was sufficient against physical attackers. The mitigation — adopting a pre‑boot PIN and restricting WinRE — is straightforward and should be implemented immediately. Once Microsoft delivers a final patch, device encryption can be re‑evaluated with the confidence that the recovery bypass has been closed. Until then, securing the boot chain is the surest defence against YellowKey.