The attack abuses a trust relationship inside the Windows recovery workflow by placing specially crafted “FsTx” files onto a USB drive or EFI partition.
Microsoft Confirms Public Exploit AvailabilityIn an advisory published Tuesday, Microsoft acknowledged that exploit code for YellowKey is already publicly available, raising the likelihood of real-world abuse.
“Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as ‘YellowKey,’” the company said.
Microsoft’s Recommended MitigationUntil a permanent patch is released, Microsoft is advising administrators to manually modify Windows Recovery Environment configurations.
Re-establishing BitLocker TrustOrganizations must then reconfigure BitLocker trust relationships to ensure the modified recovery environment is recognized as secure.
Researchers Warn Publicly Released Exploit Could Allow Attackers to Access Encrypted Windows Systems With Physical Access
Microsoft Security Response Center has issued an emergency mitigation for a newly disclosed BitLocker bypass vulnerability known as “YellowKey,” after security researchers publicly released proof-of-concept exploit code capable of circumventing Windows disk encryption protections.
The flaw, officially tracked as CVE-2026-45585, affects multiple modern versions of Windows and Windows Server and has intensified concerns across the cybersecurity community over the security of Trusted Platform Module (TPM)-only encryption deployments.
Although Microsoft has not yet released a full security patch, the company confirmed Tuesday that it is actively working to mitigate exploitation risks after researchers disclosed technical details and attack instructions online.
The vulnerability carries a CVSS severity score of 6.8 and has been classified as a “security feature bypass,” meaning attackers can circumvent built-in protections without necessarily exploiting remote code execution or privilege escalation flaws.
What Is YellowKey?
YellowKey was publicly disclosed by independent security researcher Chaotic Eclipse, who published technical findings and exploit demonstrations showing how BitLocker-encrypted systems could be accessed during the Windows Recovery Environment (WinRE) boot process.
The attack abuses a trust relationship inside the Windows recovery workflow by placing specially crafted “FsTx” files onto a USB drive or EFI partition. Once inserted into a vulnerable machine, the attacker can reboot the device into WinRE and trigger an unrestricted command shell during the recovery process.
The exploit reportedly succeeds by holding the CTRL key at a specific stage during recovery initialization, causing the system to spawn a shell with elevated privileges and unrestricted access to the encrypted volume.
In a technical write-up published online, the researcher stated:
“If you did everything properly, a shell will spawn with unrestricted access to the BitLocker protected volume.”
The vulnerability effectively undermines one of BitLocker’s core assumptions: that pre-boot recovery operations can be trusted before authentication is fully enforced.
Microsoft Confirms Public Exploit Availability
In an advisory published Tuesday, Microsoft acknowledged that exploit code for YellowKey is already publicly available, raising the likelihood of real-world abuse.
“Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as ‘YellowKey,’” the company said. “The proof of concept for this vulnerability has been made public, violating coordinated vulnerability best practices.”
The company stopped short of confirming active exploitation in the wild but warned that attackers with physical access to targeted systems could potentially bypass BitLocker Device Encryption protections and access sensitive data stored on encrypted drives.
The disclosure has reignited long-standing industry concerns over attacks targeting physical access scenarios, especially against laptops, enterprise endpoints, government systems, and devices lost or stolen during travel.
Systems Confirmed Vulnerable
Microsoft said the flaw impacts the following operating systems:
Windows 11 Version 24H2 for x64-based Systems
Windows 11 Version 25H2 for x64-based Systems
Windows 11 Version 26H1 for x64-based Systems
Windows Server 2025
Windows Server 2025 Server Core installations
Organizations relying on TPM-only BitLocker authentication are particularly exposed.
Why Security Experts Are Concerned
Unlike traditional malware attacks that require phishing emails, malicious downloads, or network compromise, YellowKey operates entirely through physical access and pre-boot manipulation.
The attack as especially dangerous because it bypasses encryption without requiring credentials or administrative access.
To break encryption, YellowKey abuses a behavioral trust assumption in the recovery interface, allowing attackers to spawn an unrestricted shell with full access to the encrypted volume during the pre-boot recovery sequence.
The exploit’s simplicity significantly increases its potential impact because YellowKey doesn't require software installation, existing credentials, or network access to break encryption, any machine that has a USB port and can be rebooted can be a target.
The vulnerability could be particularly problematic for:
Corporate laptops
Government-issued devices
Shared workstations
Border-crossing travelers
Data center recovery systems
Lost or stolen endpoints
The attack also highlights a growing category of “evil maid” attacks — scenarios in which adversaries briefly gain physical access to a machine and manipulate the boot environment or firmware.
Researchers Point to Weakness in WinRE Trust Model
Security researcher Will Dormann explained that YellowKey exploits how Windows Recovery Environment automatically launches the FsTx Auto Recovery Utility, known as autofstx.exe.
According to Dormann, the mitigation recommended by Microsoft disables this automatic recovery behavior, preventing Transactional NTFS replay operations that enable the attack chain.
“Specifically, you prevent the FsTx Auto Recovery Utility, autofstx.exe, from automatically starting when the WinRE image launches,” Dormann explained.
The issue appears rooted in how WinRE handles recovery scripts and transactional file operations before BitLocker authentication fully secures the volume.
Recovery environments are often overlooked in enterprise hardening programs despite being highly privileged components of the operating system.
Microsoft’s Recommended Mitigation
Until a permanent patch is released, Microsoft is advising administrators to manually modify Windows Recovery Environment configurations.
The mitigation process includes:
1. Mounting the WinRE Image
Administrators must first mount the recovery image on each affected device.
2. Editing the Registry Hive
The system registry hive associated with the mounted WinRE image must then be loaded manually.
3. Removing autofstx.exe
Microsoft recommends removing the autofstx.exe entry from the BootExecute registry value under Session Manager.
4. Saving and Rebuilding the Recovery Image
After the registry modification, administrators must save changes, unload the registry hive, and re-commit the modified WinRE image.
5. Re-establishing BitLocker Trust
Organizations must then reconfigure BitLocker trust relationships to ensure the modified recovery environment is recognized as secure.
Mitigation process may require careful testing before broad deployment in enterprise environments, particularly on systems using customized recovery partitions or automated provisioning workflows.
TPM-Only Encryption Under Scrutiny
Perhaps the most significant aspect of Microsoft’s advisory is its strong recommendation that organizations abandon TPM-only BitLocker authentication.
The company urged users to migrate to TPM+PIN configurations, which require users to enter a startup PIN during boot in addition to TPM validation.
Under TPM-only mode, the Trusted Platform Module automatically unlocks the encrypted drive during startup if system integrity checks pass. While convenient, the configuration has long faced criticism from security researchers who argue it provides insufficient protection against sophisticated physical attacks.
Microsoft said organizations can enable TPM+PIN using:
PowerShell
Command-line utilities
Microsoft Intune
Group Policy
Control Panel administrative settings
For systems not yet encrypted, administrators are advised to enable the policy:
“Require additional authentication at startup”
They should also configure:
“Configure TPM startup PIN” → “Require startup PIN with TPM”
The recommendation reflects a broader industry shift toward layered pre-boot authentication instead of relying exclusively on hardware-backed trust.
Public Disclosure Sparks Debate Over Responsible Research
The publication of working proof-of-concept exploit code before a patch became available has sparked renewed debate over coordinated vulnerability disclosure practices.
Microsoft criticized the public release, stating the disclosure violated “coordinated vulnerability best practices.”
However, some researchers argue that public disclosure pressures vendors to move faster on mitigations and helps defenders assess real-world exposure more accurately.
The debate reflects growing tensions within the cybersecurity industry over how quickly exploit details should be released after vulnerabilities are discovered.
Broader Implications for Enterprise Security
The emergence of YellowKey underscores a broader reality facing enterprise defenders: encryption alone is not always sufficient if recovery and boot environments remain vulnerable.
Modern attacks increasingly target:
Firmware
UEFI components
Recovery partitions
Bootloaders
Pre-authentication workflows
As organizations continue adopting hardware-based encryption at scale, experts warn that attackers are shifting attention toward trusted boot paths and recovery mechanisms that often receive less scrutiny.
Security teams are now being urged to:
Audit BitLocker deployment configurations
Disable unnecessary recovery functionality
Enforce TPM+PIN policies
Restrict USB boot access
Harden BIOS/UEFI settings
Monitor for unauthorized WinRE modifications
For many enterprises, YellowKey may become a pivotal reminder that physical access remains one of the most dangerous threat vectors in modern cybersecurity.
Microsoft has not yet announced when a full security update addressing CVE-2026-45585 will become available.
