Microsoft Closes the BitLocker Backdoor as New Bypasses Emerge

Microsoft shut down a Windows 11 bug that let anyone with a USB stick and a few seconds of physical access unlock a BitLocker-protected drive, no password required. The fix shipped June 9 inside a record 206-vulnerability Patch Tuesday, the largest single update since Microsoft started the program in October 2003.

That one bug is fixed. The researcher who exposed it, using the handle Nightmare-Eclipse, has kept leaking new BitLocker and Secure Boot bypasses in the weeks since, faster than Microsoft can patch them, while other hackers have started handing over exploits of their own in solidarity.

Microsoft’s Record Patch Tuesday Closes the BitLocker Backdoor

The June update patched three zero-day exploits published a month earlier by a researcher going by Chaotic Eclipse, also known as Nightmare-Eclipse: YellowKey, a Windows Recovery Environment bug that bypasses BitLocker, alongside GreenPlasma and MiniPlasma, two privilege-escalation flaws that hand attackers a SYSTEM-level shell.

Microsoft folded in a second, closely related fix in the same cycle. CVE-2026-50507 is described in the company’s own advisory language as “a protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature.”

MiniPlasma is the odd one in that list. Its CVE number dates to 2020, and Microsoft credits the original report to Google Project Zero researcher James Forshaw, meaning the bug sat unfixed for roughly six years before Nightmare-Eclipse gave it a nickname and forced the issue.

The update’s overall scale drew as much attention as the BitLocker fixes. CrowdStrike’s breakdown of the release found elevation-of-privilege bugs made up nearly a third of the 206 fixes, with Windows itself receiving more patches than any other product family. Arctic Wolf counted eight separate Secure Boot bypass patches in the same release, part of a pattern it flagged of attackers investing in pre-boot and full-disk-encryption weaknesses.

The former record holder, set the previous October, was 175 vulnerabilities. Some of that growth may not be Microsoft finding problems by hand alone; researchers cited in trade coverage have pointed to AI-assisted vulnerability research as one driver behind the record count, though Microsoft hasn’t detailed how much of the June haul came from automated tools.

A USB Stick and the Ctrl Key Were All It Took

YellowKey’s mechanics are almost insultingly simple for a full-disk-encryption bypass. An attacker copies a specially crafted “FsTx” folder onto a USB drive or the EFI partition, plugs it into a locked Windows 11 machine, reboots into the Windows Recovery Environment, and holds the Ctrl key. A command shell opens with full access to the BitLocker-protected volume, no credentials required.

Security researcher Will Dormann traced the mechanism to how WinRE processes NTFS transaction logs. The crafted files cause a system file called winpeshl.ini to be deleted, and when recovery mode looks for it and cannot find it, it falls back to a raw command prompt, “with the disk still unlocked,” Dormann said.

The bypass only works by default against “TPM-only” BitLocker configurations, the setup most consumer PCs ship with, because those drives unlock automatically at boot without asking for a PIN. Switching to TPM+PIN blocks the published exploit, Microsoft says, though Nightmare-Eclipse maintains a separate, unpublished version defeats that too.

Microsoft’s own offensive security team had already mapped this exact terrain. A year earlier, researchers on its Security Testing and Offensive Research team presented a WinRE-based BitLocker extraction technique called BitUnlocker at Black Hat and DEF CON, and one resulting flaw, CVE-2025-48003, was patched in July 2025, ten months before YellowKey surfaced.

The Backdoor Claim Microsoft Never Confirmed

Nightmare-Eclipse did not describe YellowKey as an ordinary bug. Writing on GitHub, the researcher called it “one of the most insane discoveries I ever found” and argued the vulnerable WinRE component was deliberately hidden, since a component with the same name exists in standard Windows installations without the behavior that triggers the bypass.

Independent researcher Kevin Beaumont reproduced the exploit and told BleepingComputer he agreed BitLocker had a backdoor, recommending a BitLocker PIN and a BIOS password as a defense. Other researchers who reproduced the same steps stopped short of endorsing that word, describing the WinRE behavior as reproducible and strange rather than proven intentional.

Microsoft has never used the word itself. Its advisory calls YellowKey only a “security feature bypass” and objected to the proof-of-concept release, saying it had “been made public violating coordinated vulnerability best practices,” without addressing whether the underlying design was deliberate. Under Microsoft’s own disclosure rules, the company recognizes and pays bounties for vulnerabilities reported through coordinated disclosure rather than published outright.

What Windows 11 Users Should Do Now

For anyone who hasn’t installed the June update yet, Microsoft’s guidance hasn’t changed since May: treat TPM-only BitLocker as exposed and act on it.

• Switch to TPM+PIN protection – enable it through PowerShell, the command line, or the BitLocker control panel so a PIN is required before the drive unlocks at startup.
• Enforce it across a fleet – administrators can require the change through Microsoft Intune or Group Policy’s “Require additional authentication at startup” setting.
• Watch for unexpected WinRE boots – most people never enter recovery mode on their own, so an unplanned trip into it is worth investigating.

None of that guarantees safety against the version Nightmare-Eclipse says still works against TPM+PIN, since that proof of concept has never been published. Microsoft hasn’t addressed the claim directly, and the June patch notes make no mention of it.

Why Did Microsoft Threaten Legal Action First?

Microsoft’s first public response treated the leaks as a security emergency rather than a policy debate. The company said the disclosures handed attackers a road map and noted that several earlier bugs were already being exploited before it could ship fixes, then raised the possibility of legal action against the person responsible.

A Microsoft Security Response Center post called the leaks reckless, describing the researcher’s actions as criminal and warning that “our Digital Crimes Unit will continue bringing cases against these actors and those that enable their criminal activity.”

The backlash was immediate. Former Microsoft employee Kevin Beaumont called the company’s position “a dumpster fire of its own making,” and other prominent voices, including Katie Moussouris, who built Microsoft’s original bug bounty program, said the response sent contradictory signals. Zero Day Initiative’s Dustin Childs, who spent seven years inside Microsoft security, argued the fault ran both ways: “The vendor has some responsibility as well, so to go out publicly stating this person violated CVD without showing any of the correspondence seems bold.”

GitHub, which Microsoft owns, banned Nightmare-Eclipse’s account on May 27. The backlash forced what quickly became Microsoft’s zero-day policy retreat, dropping the threat of legal action entirely within days: “To be clear about our approach to legal matters, we have no intention to pursue action against individuals conducting or publishing their security research.”

Three of the researcher’s earlier bugs, BlueHammer, RedSun, and UnDefend, were already being exploited by attackers by the time Microsoft caught up, prompting the Cybersecurity and Infrastructure Security Agency to set its own deadline for federal agencies to patch two of the affected Defender flaws.

Nightmare-Eclipse also accused Microsoft of retaliating directly.

[They were] told personally by [Microsoft] that they will ruin my life, and they did.

The researcher wrote that in a blog post, describing Microsoft’s actions as vindictive and claiming the company banned their GitHub account and deleted their Microsoft account in retaliation for publishing the exploits. Microsoft has denied deactivating any account, saying it does not remove MSRC researcher portal accounts and cannot confirm which account the researcher means.

What we know:

• Confirmed: Independent researchers Will Dormann and Kevin Beaumont both reproduced the YellowKey bypass on Windows 11 systems.
• Confirmed: GitHub banned Nightmare-Eclipse’s account on May 27, and Microsoft dropped its threat of legal action on June 1.
• Confirmed: Microsoft patched YellowKey and a second BitLocker bypass, CVE-2026-50507, in the same June 9 update.

What’s unconfirmed:

• Disputed: Whether the WinRE component behind YellowKey was deliberately built as a backdoor, as the researcher claims.
• Disputed: Whether Microsoft actually deactivated the researcher’s Microsoft account.
• Disputed: Whether TPM+PIN configurations carry the unpublished variant the researcher says is being withheld.

None of that got resolved before the patch shipped. It didn’t get resolved after, either.

Eight Zero-Days Later, the Dispute Isn’t Over

Patching YellowKey did not end anything. Within two days of the June 9 update, Nightmare-Eclipse published RoguePlanet, a local privilege-escalation bug, then GreatXML, another claimed BitLocker bypass the researcher says was an accidental discovery that took four hours to find.

That brought the researcher’s total to eight zero-days: RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, MiniPlasma, RoguePlanet, and GreatXML.

GreatXML allegedly works on any machine that has ever run a Microsoft Defender Offline scan, using a copied “unattend.xml” file and Recovery directory to spawn a shell after a Shift-click restart into WinRE. Dormann reproduced the steps but called the write-up flawed: triggering a Defender Offline scan requires being logged into Windows with admin credentials already, at which point BitLocker could simply be turned off directly.

The bans did little to slow things down. Windows zero-days stayed live despite the GitHub and GitLab bans, with proof-of-concept code migrating to new repositories almost as fast as old ones were pulled.

Other researchers have since joined in directly. One account on X reported that fellow security researchers were handing Nightmare-Eclipse vulnerabilities for free, starting with a bug called Bitskrieg, described as violating Secure Boot trust and fully bypassing BitLocker. Nightmare-Eclipse’s own blog corroborated the shift, saying other researchers had begun approaching them directly and confirming a new Secure Boot flaw that “fully bypasses BitLocker” was on the way.

Nightmare-Eclipse had promised a dramatic release for July 14. Weeks later the tone changed: “I will be unable to mass disclose zerodays in July 14th, RoguePlanet took way more time than expected and truly drained me,” the researcher wrote, adding they might take a break. A day later, they published GreatXML anyway.

Microsoft, meanwhile, kept working through the backlog. Malwarebytes reported the company fixed RoguePlanet in Windows Defender on July 9, a month after it surfaced. That leaves the researcher’s own promised date four days away.

Nightmare-Eclipse summed up the standoff back in May, in the same post that announced GreenPlasma and YellowKey: “The fire will go as long as you want, unless you extinguish it or until there nothing left to burn.”

Frequently Asked Questions

What Is the YellowKey BitLocker Vulnerability?

YellowKey, tracked as CVE-2026-45585 with a CVSS score of 6.8, is a Windows Recovery Environment flaw that lets someone with physical access to a Windows 11 or Windows Server 2022/2025 machine spawn an unrestricted command shell on a BitLocker-protected drive using a USB drive and the Ctrl key, without a password.

Is Windows 10 Affected By YellowKey Or GreenPlasma?

No. Researchers who reproduced the exploit found it works only on Windows 11 and Windows Server 2022/2025; Windows 10 machines are not vulnerable to the YellowKey bypass, though neither Microsoft nor the researcher has explained why the recovery environment behaves differently across versions.

Did Microsoft Confirm BitLocker Had an Intentional Backdoor?

No. Microsoft’s advisories addressed the technical bypass and objected to the release of proof-of-concept code, but the company has never confirmed or denied that the WinRE behavior was intentionally designed, and researchers who reproduced the bug describe that specific claim as unverified.

How Do I Protect a BitLocker Drive Without the June Update?

Switch BitLocker from TPM-only to TPM+PIN protection, which Microsoft says blocks the published exploit. On an already-encrypted device, that means running manage-bde -protectors -add C: -TPMAndPIN from an elevated command prompt or adding the protector through the BitLocker control panel.

How Many Zero-Days Has Nightmare-Eclipse Released in Total?

By mid-June, the researcher’s count reached eight: RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, MiniPlasma, RoguePlanet, and GreatXML. A ninth flaw, called Bitskrieg, was contributed by a different researcher as a show of solidarity rather than released by Nightmare-Eclipse directly.