Microsoft shares mitigation for YellowKey Windows zero-day
Microsoft releases mitigation for YellowKey BitLocker zero-day disclosed by Nightmare Eclipse.
Microsoft has published mitigations for YellowKey (CVE-2026-45585), a Windows BitLocker zero-day vulnerability that allows attackers to access protected drives by placing specially crafted FsTx files on USB or EFI partitions and rebooting into WinRE. The flaw was disclosed by anonymous researcher Nightmare Eclipse, who also leaked multiple other zero-day vulnerabilities (BlueHammer, RedSun, GreenPlasma, and UnDefend) in protest of Microsoft's vulnerability disclosure handling. Microsoft recommends removing autofstx.exe from Session Manager boot execution and configuring BitLocker to TPM+PIN mode as interim protections.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe YellowKey vulnerability demonstrates how attackers can bypass BitLocker disk encryption by exploiting Windows Recovery Environment (WinRE) processes through malicious FsTx files placed on external media. This zero-day highlights the critical gap between having encryption enabled and having it properly configured with multiple authentication factors. The researcher's public disclosure of multiple vulnerabilities also underscores the importance of maintaining good relationships with the security research community and having robust vulnerability management processes.
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-45585
- cve — CVE-2026-33825
- malware — RedSun
- malware — GreenPlasma
- malware — UnDefend