Microsoft Releases Mitigation for Yellow Key Bit Locker Bypass CVE-2026-45585 Exploit
Summary: Microsoft released a mitigation on Tuesday for a BitLocker bypass dubbed YellowKey, tracked as CVE-2026-45585 with a CVSS score of 6.8, after researcher Chaotic Eclipse (aka Nightmare-Eclipse) published a proof of concept. The exploit places crafted 'FsTx' files on a USB drive or EFI partition, reboots the target into Windows Recovery Environment, and spawns an unrestricted shell by holding CTRL, affecting Windows 11 24H2, 25H2, 26H1 for x64, Windows Server 2025, and Server Core.
Why it matters: YellowKey needs no software installation, credentials, or network access - only a USB port and a reboot - which LevelBlue says makes it viable for device theft, border inspections, insider access, and supply chain exposure. Microsoft's fix depends on you moving encrypted fleets from TPM-only to TPM+PIN, a configuration change that reaches every protected endpoint.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-45585
- Related