Microsoft has officially acknowledged the “YellowKey” BitLocker bypass vulnerability and has issued interim mitigation guidance, though a permanent patch has not yet been released. Administrators are being advised to take proactive steps, including disabling a specific recovery utility (autofstx.exe) and enabling TPM+PIN authentication to reduce exposure.
The vulnerability, which surfaced publicly after security researcher Chaotic Eclipse released details and proof-of-concept code, has been assigned CVE-2026-45585 with a CVSS score of 6.8. It affects multiple versions of Windows 11 specifically 24H2, 25H2, and 26H1 on x64 systems as well as Windows Server 2025 across both standard and Server Core deployments.
In its advisory, Microsoft confirmed awareness of the issue, stating that the so-called “YellowKey” flaw represents a bypass of BitLocker’s security protections. The company noted that the public disclosure of exploit code occurred outside the standard coordinated vulnerability disclosure process, which typically allows vendors time to address issues before they become widely exploitable.
The researcher behind the release, Chaotic Eclipse, has drawn attention previously for rapidly publishing multiple Windows vulnerabilities, including those nicknamed GreenPlasma, BlueHammer, RedSun, UnDefend, and MiniPlasma. Microsoft has criticized the approach of releasing functional exploit code without coordination, emphasizing the risks it creates for users and organizations.
The YellowKey exploit itself requires physical access to a target system, which is why it has a moderate CVSS rating instead of a higher severity score. An attacker would need hands-on control of the device to execute the attack. The method involves placing specially crafted FsTx files either on a USB drive or within the system’s EFI partition. After rebooting into the Windows Recovery Environment (WinRE) and holding the CTRL key during startup, the attacker can trigger conditions that open a command shell with unrestricted access to the BitLocker-encrypted drive.
Effectively, if executed correctly, the attack bypasses BitLocker protections entirely without requiring brute-force attempts or access to encryption keys. As described in the original disclosure, success simply depends on placing the right files in the correct locations and rebooting the system under specific conditions.
At the core of the vulnerability is a component called the FsTx Auto Recovery Utility (autofstx.exe), which automatically runs when the WinRE environment starts. This utility initiates a Transactional NTFS replay process that ultimately removes the winpeshl.ini file. That file plays a critical role in controlling recovery environment behavior, and its removal inadvertently enables an unrestricted command shell.
Because no official patch is currently available, Microsoft has outlined a manual mitigation strategy. This process involves mounting the WinRE image on affected devices, loading its associated registry hive, and modifying the BootExecute value under the Session Manager key to remove the autofstx.exe entry. After making the change, administrators must save the registry modifications, unmount and commit the WinRE image, and then re-establish BitLocker’s trust relationship with the recovery environment.
By preventing autofstx.exe from executing automatically, the NTFS replay process that deletes winpeshl.ini is effectively avoided, thereby blocking the exploit chain. However, this process requires manual intervention and careful execution, particularly in enterprise environments with many devices.
Security experts, including Will Dormann, have highlighted an additional and arguably more impactful mitigation: transitioning from TPM-only BitLocker protection to TPM+PIN authentication. In TPM-only configurations, the system automatically unlocks the encrypted drive during boot, which makes it convenient but inherently more vulnerable to physical attacks. Adding a PIN requirement ensures that the drive remains encrypted unless the correct PIN is entered at startup, effectively neutralizing the attack vector used in YellowKey.
There is, however, an important nuance. Even if an attacker attempts to reintroduce a vulnerable version of the WinRE environment, doing so breaks the trust relationship between BitLocker and WinRE. As a result, although a command prompt may still be accessible, the encrypted drive will not automatically unlock, limiting the attacker’s ability to access data.
Microsoft has also provided deployment guidance for organizations. Systems already using TPM-only encryption can be upgraded to TPM+PIN through PowerShell, command-line tools, or system settings. For new or unencrypted systems, administrators are encouraged to enforce the “Require additional authentication at startup” policy via Group Policy or Microsoft Intune, ensuring that a startup PIN is mandatory.
While the necessity of physical access reduces the likelihood of widespread exploitation, the vulnerability remains significant. Devices such as laptops are frequently lost or stolen, and targeted attackers may intentionally obtain physical access. Since BitLocker is designed specifically to protect data under such circumstances, any reliable bypass undermines its core purpose.
Compounding the issue, the mitigation process is not trivial to implement at scale. Organizations managing large device fleets may need to script changes to WinRE images and deploy policy updates across their environment. This requires deliberate planning and execution, as the issue will not be automatically resolved through routine updates like Patch Tuesday.
In summary, while Microsoft has provided guidance to reduce risk, the absence of a formal patch means organizations must act manually to secure their systems against the YellowKey vulnerability.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
