YellowKey: Three-Minute BitLocker Bypass in Windows 11 WinRE
A newly disclosed zero-day, dubbed YellowKey, allows an attacker with physical access to defeat Windows 11 BitLocker full-disk encryption in roughly three minutes using a USB drive and the CTRL key. The exploit was published on May 12, 2026 by researcher Nightmare-Eclipse (aka Chaotic Eclipse), who described the vulnerable component as "almost like a backdoor."
Background: A Six-Week Zero-Day Campaign
Nightmare-Eclipse claims a personal vendetta against Microsoft, alleging MSRC staff ruined his life after a dispute over a protocol violation. Beginning April 2026, he has released one zero-day per month on the day after Patch Tuesday:
| Date | Codename | Type | Status | |------|----------|------|--------| | 2026-04-02 | RedSun | Windows Defender privilege escalation (SYSTEM) | Unfixed | | 2026-04-03 | BlueHammer | Defender update mechanism TOCTOU, 60-second elevation | Fixed (CVE-2026-33825) | | 2026-04-15 | UnDefend | Disables/blocks Defender signature updates | Unfixed | | 2026-04 | MiniPlasma | Privilege escalation | Unfixed | | 2026-05-12 | YellowKey | BitLocker full-disk encryption bypass | Microsoft mitigation released, no patch | | 2026-05-12 | GreenPlasma | CTFMON elevation to SYSTEM | Unfixed |
Security firm Huntress reported on April 20 that BlueHammer, RedSun, and UnDefend had already been used in real intrusions — attackers chained public PoCs after initial FortiGate SSL VPN compromise, meaning less than two weeks elapsed from publication to in-the-wild exploitation.
The YellowKey Attack
Steps
1. Place a folder named FsTx on the USB drive under System Volume Information\FsTx
2. Insert the USB drive into the target (BitLocker-enabled) machine
3. Shift-click Restart to boot into the Windows Recovery Environment (WinRE)
4. After clicking Restart, release Shift and immediately hold CTRL
5. If timed correctly, a command shell opens with unrestricted access to the BitLocker-encrypted volume
No password, cracking, network, or software installation required. A variant eliminates the USB drive entirely: remove the disk, write the FsTx folder to the EFI system partition on another machine, and reinsert it.
Technical Root Cause
The issue lies in autofstx.exe (FsTx Auto Recovery Utility), an undocumented WinRE component. On WinRE startup, it automatically runs, triggering a Transactional NTFS (TxF) replay operation that deletes winpeshl.ini — the config file that tells WinRE which interface to load. Without it, WinRE falls back to a completely unrestricted shell, while the BitLocker-protected volume is already mounted and decrypted during the boot phase.
Why "Backdoor"?
The researcher cites three points:
1. Component hiding: autofstx.exe exists in normal Windows installs, but only the WinRE copy contains the winpeshl.ini-deleting functionality.
2. Windows 10 immunity: Windows 10 is entirely unaffected — not because it was patched, but because the feature never existed there.
3. No documentation: The component has virtually no public documentation, and Microsoft has not explained why it holds privileges to delete winpeshl.ini.
Barracuda's analysis notes the researcher's familiarity with Microsoft's codebase "suggests insider-level knowledge."
Microsoft's Response
- May 20: Microsoft published CVE-2026-45585 (CVSS 6.8)
- Released a PowerShell mitigation script,
Remove-AutoFsTxFromWinRE.ps1, which mounts each device's WinRE image, removes theautofstx.exeentry from the Session ManagerBootExecuteregistry value, and reseals WinRE - Recommended switching from TPM-only to TPM+PIN mode
- A full security patch is still in development
- Windows 11 24H2 / 25H2 / 26H1 (x64)
- Windows Server 2025 / Server Core
- Windows Server 2022 (possibly affected under specific deployments, not officially confirmed)
- YellowKey GitHub: https://github.com/Nightmare-Eclipse/YellowKey
- Microsoft CVE-2026-45585 advisory
- Barracuda analysis: https://blog.barracuda.com/2026/05/19/nightmare-eclipse-zero-days-grudge
- Huntress in-the-wild exploitation report: https://www.huntress.com/blog/nightmare-eclipse-intrusion
- TechRadar: https://www.techradar.com/pro/security/this-worrying-microsoft-bitlocker-backdoor
- CyberNews: https://cybernews.com/security/researcher-releases-bitlocker-bypass-and-privilege-escalation-exploit/
However, the researcher claims to hold an additional PoC that bypasses TPM+PIN, which he chose not to release. Independent researcher Kevin Beaumont verified YellowKey works in TPM-only mode and recommended TPM+PIN plus a BIOS password; Nightmare-Eclipse maintains this does not truly mitigate the threat.
Until a full patch ships, affected devices should be treated as effectively unencrypted.
Affected Systems
Not affected: Windows 10
Recommendations
For individual users:
1. Check BitLocker configuration; switch TPM-only to TPM+PIN (via Group Policy or manage-bde on Pro/Enterprise editions)
2. Run Microsoft's mitigation script Remove-AutoFsTxFromWinRE.ps1
3. Set a BIOS password to prevent boot-order tampering
4. Maintain physical security of devices
For enterprise admins: 1. Audit BitLocker configurations on all endpoints 2. Enforce TPM+PIN via Intune/GPO 3. Deploy the mitigation script at scale 4. Monitor MSRC for the official patch 5. Review VPN logs — prior exploits in the series have seen in-the-wild use, so attackers may compromise remotely before gaining physical access
Afterword
Nightmare-Eclipse has threatened further releases, promising "a big surprise" for the next Patch Tuesday and hinting at a dead man's switch that would automatically publish more exploits if anything happens to him.
The YellowKey episode is both a technical vulnerability and a mirror — reflecting the fragility of the security research ecosystem, a large vendor's treatment of individuals, and our blind trust in the assumption that encryption equals security.