CVE-2026-45585 (YellowKey): Unpatched BitLocker Bypass Gives Physical Attacker Full Drive Access — Mitigate Now

Microsoft published mitigation guidance on May 20 for CVE-2026-45585, an unpatched zero-day that bypasses BitLocker encryption on Windows 11 and Windows Server 2025. There is no patch yet. The mitigation is manual and requires a configuration change.

What the vulnerability does

An attacker with brief physical access — a few minutes at an unlocked or rebooting machine — can decrypt a BitLocker-protected drive without the user’s PIN or password. The attack uses only a USB drive and native Windows utilities, leaving no persistent hardware artifacts.

The attack chain, documented by researcher “Chaotic Eclipse” (also known as Nightmare-Eclipse):

1. Place crafted FsTx files on a USB drive or the EFI partition
2. Boot into Windows Recovery Environment (WinRE)
3. Trigger the Transactional NTFS (TxF) replay mechanism using the CTRL key at a specific WinRE prompt
4. The TxF replay deletes winpeshl.ini, surfacing an unrestricted command prompt
5. The BitLocker-protected volume is already unlocked at this point — full read/write access is available without any credentials

The attack exploits the interaction between WinRE’s recovery boot path and TxF’s transaction replay logic. No third-party tools are required. No hardware implant is left behind.

Severity and affected systems

• CVE: CVE-2026-45585
• CVSS: 6.8 (Medium — reduced from High because physical access is required)
• Affected: Windows 11 24H2, 25H2, 26H1 (x64); Windows Server 2025
• Not affected: Systems with TPM+PIN or passphrase-only BitLocker mode already configured

The CVSS score of 6.8 undersells the real-world risk. TPM-only BitLocker — the default configuration that most enterprise deployments use — provides zero protection against this attack. Any laptop left unattended, any device stolen from a bag, any machine in a shared office space is vulnerable.

Mitigation steps

No patch is available. Microsoft’s guidance: switch from TPM-only mode to TPM+PIN or passphrase mode.

Via PowerShell (run as Administrator):

manage-bde -protectors -add C: -TPMAndPIN

You’ll be prompted to set a PIN. Then verify the new protector is active and remove the TPM-only protector:

manage-bde -status C:
manage-bde -protectors -delete C: -type TPM

Via Control Panel: BitLocker Drive Encryption → Change how drive is unlocked at startup → Enter a PIN.

This change means users will need to enter a PIN at every boot. That’s the tradeoff. For high-value devices — executives, engineers with production access, anyone carrying sensitive data — it’s the correct call right now.

What to watch for

Microsoft has not given a timeline for a patch. The vulnerability is in the interaction between WinRE and TxF, two deep OS components, and any fix will require careful regression testing. Watch for a Patch Tuesday update in June or an out-of-band release if exploitation picks up.

If you manage a fleet, audit which machines are running TPM-only mode and prioritize switching the highest-risk devices first.