Site icon Fix I.T. Phill – Your Go-To Tech Guru

YellowKey CVE-2026-45585: BitLocker WinRE Mitigation Guide

admin
YellowKey CVE-2026-45585 BitLocker WinRE mitigation guide for Windows 11, Windows Server 2025, TPM PIN, and recovery key escrow

YellowKey CVE-2026-45585 BitLocker WinRE mitigation guide for Windows 11, Windows Server 2025, TPM PIN, and recovery key escrow

Update for May 21, 2026: Microsoft is tracking YellowKey as CVE-2026-45585, a Windows BitLocker security feature bypass vulnerability. This is separate from MiniPlasma. YellowKey is about BitLocker and the Windows Recovery Environment; MiniPlasma is about local privilege escalation after code runs inside Windows.

YellowKey matters because BitLocker is supposed to protect data on stolen, lost, or unattended devices. Microsoft says an attacker with physical access to an affected system could bypass BitLocker Device Encryption on the system drive and gain access to encrypted data. Microsoft currently rates the issue Important with CVSS 6.8, lists it as publicly disclosed, and says exploitation is more likely while a full security update is still pending.

Affected Windows Versions

Microsoft’s affected-product API and NVD list the following affected products for CVE-2026-45585:

During this pass, CVE-2026-45585 was not listed in the CISA Known Exploited Vulnerabilities catalog. That can change quickly, so do not use KEV status as the only priority signal. Public disclosure plus BitLocker impact is enough to justify fast review.

Who Should Prioritize This

What Microsoft Recommends

Microsoft currently gives two mitigation paths. Use the official MSRC guidance for the exact steps and test on a pilot machine before rolling out broadly.

  1. Mitigate through Windows Recovery Environment servicing. Microsoft describes mounting the WinRE image, changing the relevant Session Manager boot behavior, committing the image, and then reestablishing BitLocker trust for WinRE. This is powerful maintenance work. Back up the system first and do not improvise registry edits from memory.
  2. Move BitLocker from TPM-only to TPM plus startup PIN where operationally possible. Microsoft lists PowerShell, command-line, Control Panel, Intune, and Group Policy methods. Make sure recovery keys are escrowed and tested before changing protector policy, especially for remote users and servers that may reboot unattended.

For devices that are not encrypted yet, Microsoft points admins toward Intune or Group Policy settings that require additional authentication at startup and require a startup PIN with TPM. This is a security gain, but it changes the reboot workflow. Do not surprise users or remote server teams with a PIN prompt during off-hours maintenance.

Safe Verification Commands

These commands help verify status. They do not reproduce the issue.

winver
reagentc /info
manage-bde -status
powershell -NoProfile -Command "Get-BitLockerVolume"
powershell -NoProfile -Command "Get-ComputerInfo | Select-Object WindowsProductName, OsVersion, OsBuildNumber"
powershell -NoProfile -Command "Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10"

For Intune, WSUS, and RMM environments, turn those checks into inventory fields where possible: Windows version, build number, BitLocker protector type, WinRE enabled state, recovery key escrow status, and last successful update/reboot.

Patch Planning

At publication time, Microsoft’s CVE entry provides mitigation guidance but no KB article list for a final security update. Watch Windows Update, WSUS, Intune, your RMM patch catalog, and the Microsoft Update Catalog. When Microsoft publishes a fix, plan for reboots and post-reboot verification rather than assuming the mitigation remains the final state.

For hosting and business environments:

Role-Specific Notes

Logs And Evidence To Review

If you are investigating a lost, stolen, or tampered Windows device, review BitLocker management events, Windows Security events, recent local logons, device boot/recovery history where available, RMM check-ins, EDR timeline data, and any evidence of offline handling. For servers, include remote hands tickets and access-control records for the rack, office, or equipment room.

Customer Communication

Keep it calm and practical: “Microsoft has published mitigation guidance for a BitLocker recovery-environment issue affecting specific Windows 11 and Windows Server 2025 versions. We are checking affected systems, confirming recovery-key escrow, and staging any required mitigation or update work with reboot planning.” That is enough for most customers.

Related Fix I.T. Phill Windows Notes

Sources

Exit mobile version