Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
BitLocker
AI-generated illustration
ProductUS

BitLocker

BitLocker is Microsoft's full-disk encryption feature for Windows; two separate bypasses — YellowKey (CVE-2026-45585) and bitskrieg (CVE-2026-50507) — were patched in the June 2026 cycle.

Microsoft patched two separate BitLocker disk-encryption bypasses on 9 June, making the Windows security feature one of the notable components affected in a release covering roughly 200 flaws.

Last refreshed: 22 October 2026 · Appears in 1 active topic

Key Question

Can the June 2026 BitLocker bypasses decrypt a locked Windows drive without the key?

Timeline for BitLocker

#15 13 Oct

UTA0576 hit Ivanti VPNs before a fix

Cybersecurity: Threats and Defences
#7 9 Jun

200 fixes, six zero-days, late Exchange

Cybersecurity: Threats and Defences
View full timeline →
Follow Cybersecurity: Threats and Defences →

Background

BitLocker is Microsoft's full-disk encryption feature for Windows. It is designed to protect data stored on a Windows drive, making the feature part of the security boundary for lost, stolen or otherwise accessed devices. A bypass matters because it can defeat that protection without attacking every file separately.

On 9 June 2026, Microsoft patched two separate BitLocker bypasses in one Patch Tuesday release: YellowKey, tracked as CVE-2026-45585, and bitskrieg, tracked as CVE-2026-50507. The wider release fixed roughly 200 flaws, including six that were already being exploited. The two BitLocker flaws were distinct, so the release addressed more than one route around the same Windows protection. The available record does not say that either bypass was among the six flaws already under attack.

Common Questions
What is BitLocker and how does it work?
BitLocker is Microsoft's built-in full-disk encryption for Windows Pro, Enterprise, and Education editions. It uses AES to encrypt the entire system volume, with the key sealed by the device's TPM chip or a PIN, protecting data if a device is stolen or the drive removed.
What are the BitLocker vulnerabilities CVE-2026-45585 and CVE-2026-50507?
CVE-2026-45585 (YellowKey) and CVE-2026-50507 (bitskrieg) are two separate BitLocker bypass vulnerabilities patched by Microsoft in the June 2026 Patch Tuesday cycle. Both allow an attacker to circumvent BitLocker's disk encryption protection under specific conditions.Source: event
How do attackers bypass BitLocker encryption?
Known bypass techniques typically exploit the pre-boot authentication sequence or weaknesses in how the TPM unseals the encryption key, allowing an attacker with physical access to recover the key without the PIN or recovery credential.
Do I need to update Windows to fix the BitLocker June 2026 vulnerabilities?
Yes. There is no configuration workaround for a bypass that exploits the encryption design itself. Applying the June 2026 Patch Tuesday update is the only remediation for CVE-2026-45585 and CVE-2026-50507.Source: event
Were BitLocker recovery keys taken in the Ivanti attacks?
Volexity found that UTA0576 queried Active Directory for BitLocker recovery information after exploiting Ivanti Connect Secure. The actor wrote the search results to compressed JSON files and exfiltrated them through the exploit channel. Volexity could not determine the actor's ultimate objective.Source: Volexity
Source Material
A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-DaysMicrosoft Security Response Center Update GuideBitLocker overview - Microsoft Learn

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.