Story perspectives

Zero-Day “YellowKey” Instantly Bypasses Windows 11 BitLocker

5/15/2026

Summary

Nightmare-Eclipse Bypasses BitLocker

Nightmare-Eclipse released YellowKey, a zero-day that instantly bypasses Windows 11 BitLocker.
The exploit copies FsTx to a USB and, when Ctrl is held during a WinRE reboot, opens a command prompt that accesses encrypted volume without the recovery key.
Kevin Beaumont, Will Dormann and KevTheHermit reproduced the bypass on build 10.0.26100.1 and Windows Server 2022/2025.
Microsoft has not issued a CVE and may release a fix.
Experts advise treating machines as unencrypted.

Summary

Intrinsec Exposes Flaws

Chaotic Eclipse warned that Microsoft’s June 2026 Patch Tuesday may be chance to patch YellowKey, disclosed GreenPlasma bug in CTFMON, and released three Defender flaws after criticizing Microsoft’s disclosure process.
Intrinsec reported a BitLocker downgrade attack exploiting CVE-2025-48804 that can bypass encryption in under five minutes.
Intrinsec noted Secure Boot trusts the legacy PCA 2011 certificate, allowing a vulnerable bootmgfw.efi to run until the certificate retires next month.

History

Historical Context

On 12 May 2017 the WannaCry ransomware cryptoworm used the NSA-developed EternalBlue exploit, leaked by the Shadow Brokers, to infect over 300,000 Windows computers in 150 countries. Microsoft’s emergency patches for supported and unsupported systems and the kill-switch discovered by Marcus Hutchins curbed the spread, shaping today’s push for faster Windows updates.

1 of 3

Nightmare-Eclipse Bypasses BitLocker

Nightmare-Eclipse released YellowKey, a zero-day that instantly bypasses Windows 11 BitLocker.
The exploit copies FsTx to a USB and, when Ctrl is held during a WinRE reboot, opens a command prompt that accesses encrypted volume without the recovery key.
Kevin Beaumont, Will Dormann and KevTheHermit reproduced the bypass on build 10.0.26100.1 and Windows Server 2022/2025.
Microsoft has not issued a CVE and may release a fix.
Experts advise treating machines as unencrypted.

1 / 3