BitLocker
BitLocker is Microsoft's full-disk encryption feature for Windows; two separate bypasses — YellowKey (CVE-2026-45585) and bitskrieg (CVE-2026-50507) — were patched in the June 2026 cycle.
Last refreshed: 14 June 2026 · Appears in 1 active topic
Can the June 2026 BitLocker bypasses decrypt a locked Windows drive without the key?
Timeline for BitLocker
200 fixes, six zero-days, late Exchange
Cybersecurity: Threats and Defences- What is BitLocker and how does it work?
- BitLocker is Microsoft's built-in full-disk encryption for Windows Pro, Enterprise, and Education editions. It uses AES to encrypt the entire system volume, with the key sealed by the device's TPM chip or a PIN, protecting data if a device is stolen or the drive removed.
- What are the BitLocker vulnerabilities CVE-2026-45585 and CVE-2026-50507?
- CVE-2026-45585 (YellowKey) and CVE-2026-50507 (bitskrieg) are two separate BitLocker bypass vulnerabilities patched by Microsoft in the June 2026 Patch Tuesday cycle. Both allow an attacker to circumvent BitLocker's disk encryption protection under specific conditions.Source: event
- How do attackers bypass BitLocker encryption?
- Known bypass techniques typically exploit the pre-boot authentication sequence or weaknesses in how the TPM unseals the encryption key, allowing an attacker with physical access to recover the key without the PIN or recovery credential.
- Do I need to update Windows to fix the BitLocker June 2026 vulnerabilities?
- Yes. There is no configuration workaround for a bypass that exploits the encryption design itself. Applying the June 2026 Patch Tuesday update is the only remediation for CVE-2026-45585 and CVE-2026-50507.Source: event
Background
BitLocker is Microsoft's full-disk encryption feature, built into Windows since Vista and available across Pro, Enterprise, and Education editions. It encrypts the entire system volume using AES-128 or AES-256, with the encryption key protected by the device's Trusted Platform Module (TPM), a PIN, a USB key, or a combination. When functioning correctly, BitLocker renders a stolen or removed drive unreadable without the recovery key, and is widely deployed in enterprise environments as a baseline data-at-rest protection control. In the June 2026 Patch Tuesday cycle Microsoft patched two separate bypasses in a single release: YellowKey (CVE-2026-45585) and bitskrieg (CVE-2026-50507), an unusual double-hit on the same component.
BitLocker bypasses are serious because they defeat the primary protection against physical theft and supply-chain attacks: scenarios where full-disk encryption is the last line of defence rather than one layer among many. Earlier known bypasses, including a 2023 exploit abusing the TPM boot process, have shown that the attack surface is non-trivial; bypasses typically exploit the pre-boot authentication sequence or weaknesses in how the key is unsealed. The June 2026 pair arriving in a single cycle is notable. It suggests either parallel research threads converging on the component or a shared architectural weakness being probed from two angles.
For enterprise defenders, BitLocker's prevalence in standard Windows builds means a viable bypass is immediately relevant across the full Windows estate, not just specialist deployments. Patching is the only remediation; there is no configuration workaround for a bypass that defeats the encryption design.