We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking “Manage Cookies” at the bottom of the page. Privacy Statement Third-Party Cookies Accept Reject Manage cookies MSRC  Customer Guidance  Security Update Guide  Vulnerabilities  CVE-2026-45585 Windows BitLocker Security Feature Bypass Vulnerability New On this page  CVE-2026-45585  Subscribe RSS PowerShell  API  CSAF Security Vulnerability Released: May 19, 2026 Assigning CNA Microsoft CVE.org link CVE-2026-45585  Impact Security Feature Bypass Max Severity Important Weakness CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CVSS Source Microsoft Vector String CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C Metrics CVSS:3.1 6.8 / 6.3  Base score metrics: 6.8 / Temporal score metrics: 6.3  Expand all  Collapse all Metric Value   Base score metrics(8) Attack Vector Physical Attack Complexity Low Privileges Required None User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High   Temporal score metrics(3) Exploit Code Maturity Proof-of-Concept Remediation Level Workaround Report Confidence Confirmed Please see Common Vulnerability Scoring System for more information on the definition of these metrics. Executive Summary Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices. We are issuing this CVE to provide mitigation guidance that can be implemented to protect against this vulnerability until the security update is made available. Exploitability The following table provides an exploitability assessment for this vulnerability at the time of original publication. Publicly disclosed Yes Exploited No Exploitability assessment Exploitation More Likely Mitigations Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors might be helpful in your situation: Step 1. Mount the WinRE image on each device From an elevated command prompt run: mkdir C:\mount reagentc /mountre /path C:\mount Step 2: Mount the system registry hive of the mounted WinRE image Example command: reg load HKLM\WinREHive C:\mount\Windows\System32\config\SYSTEM Step 3: Modify BootExecute: From the mounted hive (HKLM\WinREHive), remove autofstx.exe value from Session Manager’s BootExecute REG_MULTI_SZ value. Remove autofstx.exe entry here: 'HKLM\WinREHive\ControlSet001\Control\Session Manager, BootExecute' Step 4: Save and unload reg hive: reg unload HKLM\WinREHive Step 5: Unmount and commit the updated WinRE image: reagentc /unmountre /path C:\mount /commit Step 6: Reestablish BitLocker trust for WinRE: reagentc /disable reagentc /enable Workarounds You can also be protected from exploitation by choosing from one of the following methods to add a pin to your Bitlocker protection. For devices which are already encrypted and using BitLocker with TPM-only protector: Configuring BitLocker is a prerequisite to the steps below. Reference here for more information: Configure BitLocker | Microsoft Learn. Method 1: Using PowerShell: Open PowerShell as an administrator Run Add-BitLockerKeyProtector C: -TpmAndPinProtector Enter the PIN Confirm the PIN Method 2: Using Command line (CMD): Open cmd.exe as an administrator type manage-bde -protectors -add C: -TPMAndPIN Type the PIN Confirm the PIN by typing it again. Method 3: Using Control Panel: Open Control Panel Go to BitLocker Drive Encryption Under Operating System Drive click “Change how drive is unlocked at startup” Click Enter a PIN (recommended) Enter the PIN and confirm it by typing it again. Click Set PIN Important: If you do not see an option to configure PIN or get an error message “Group policy settings do not permit the use of a PIN at startup” please follow below instructions before adding a PIN: Open gpedit.msc on a target computer Navigate to: Computer Configuration \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ Operating System Drives. Double-click Require additional authentication at startup and set it to Enabled. Then set the Configure TPM startup PIN dropdown to Require startup PIN with TPM. Click Apply and OK For devices that that are not yet encrypted: Method 1: Using Microsoft Intune Follow the steps outlined in the Encrypt Windows devices with BitLocker using Intune - Microsoft Intune | Microsoft Learn In the section Configure TPM Settings make sure Require additional authentication at startup is set to Enabled Make sure Configure TPM startup PIN is set to Require startup PIN with TPM Method 2: Using Group Policies: Follow the Configure BitLocker | Microsoft Learn Make sure that Require additional authentication at startup is set to Enabled Make sure Configure TPM startup PIN is set to Require startup PIN with TPM FAQ What kind of security feature could be bypassed by successfully exploiting this vulnerability? A successful attacker could bypass the BitLocker Device Encryption feature on the system storage device. An attacker with physical access to the target could exploit this vulnerability to gain access to encrypted data. Acknowledgements Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure. See Acknowledgements for more information. Security Updates To determine the support lifecycle for your software, see the Microsoft Support Lifecycle. Release date Descending  Edit columns  Download  Filters  Product Family  Max Severity  Impact  Platform   Clear Release date  Product Platform Impact Max Severity Article Download Build Number Assigning CNA Loading... Disclaimer The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. Revisions version revisionDate description 1.0 May 19, 2026 Information published.  How satisfied are you with the MSRC Security Update Guide? Rating  Broken  Bad  Below average  Average  Great!  Your Privacy Choices Consumer Health Privacy