A researcher who has been publishing unpatched Windows exploits has released YellowKey, a BitLocker bypass with working proof-of-concept code. There’s no patch and no CVE, and the code is already circulating on GitHub.
What’s the actual problem?
With physical access to a device, YellowKey can bypass BitLocker in minutes. All it needs is a USB stick, a specific folder structure and the ability to reboot the machine.
Based on what’s known so far, it affects Windows 11, Windows Server 2022 and Windows Server 2025. Windows 10 isn’t affected. The exploit abuses the Windows Recovery Environment, specifically the way it processes NTFS transaction logs.
The highest risk is TPM-only BitLocker, the default for most corporate Windows fleets, where the drive unlocks automatically at boot without a PIN.
Why act now when there’s no patch?
Waiting for Microsoft isn’t a strategy. The same researcher’s previous exploit, BlueHammer, was being actively exploited within four days of being published.
What to actually do
The main fix is to enforce a BitLocker startup PIN across your fleet. A strong PIN stops the known attack. Alongside that:
- Audit how many endpoints are running TPM-only BitLocker.
- Set a BIOS password and restrict changes to the boot order.
- Consider restricting access to the Windows Recovery Environment, weighing the operational impact first.
Disk encryption isn’t one of the Essential Eight strategies, but it is covered by ASD’s Information Security Manual (ISM) and its Windows hardening guidance. If your organisation works to those, it’s worth a conversation now, before Microsoft ships a patch.