Business

BitLocker YellowKey vulnerability: what UK businesses need to know now

The BitLocker YellowKey vulnerability has caused understandable concern for businesses that rely on Windows laptop encryption to protect data when devices are lost, stolen, repaired, or left unattended. For many organisations, BitLocker is one of the most important security controls on a Windows device. It is often the difference between a lost laptop being an inconvenience and a lost laptop becoming a serious data breach.

The issue has been publicly discussed as YellowKey and is tracked as CVE-2026-45585. Microsoft’s Security Update Guide lists it as a Windows BitLocker security feature bypass vulnerability, and the CVE record describes Microsoft as being aware of a publicly referenced vulnerability called YellowKey.

That sounds alarming, and in some ways it is. However, it is important to explain the risk accurately.

This is not currently best understood as “BitLocker encryption has been cracked” in the Hollywood sense. The stronger way to describe it is this: a publicly disclosed bypass appears to affect part of the Windows recovery and boot trust chain around BitLocker, where an attacker with physical access to a vulnerable device may be able to access data that should have remained protected. Independent security reporting has consistently described the issue as requiring physical access rather than being a remote attack.

For businesses, that distinction matters.

A remote attack can potentially hit thousands of machines over the internet. A physical attack usually requires the attacker to have the actual device. But laptop encryption is specifically designed to protect data when an attacker has the actual device. That is why YellowKey deserves attention from IT teams, directors, compliance officers, and anyone responsible for company laptops.

What is the BitLocker YellowKey vulnerability?

The BitLocker YellowKey vulnerability is a publicly disclosed Windows security feature bypass associated with BitLocker and the Windows Recovery Environment, often shortened to WinRE.

BitLocker is Microsoft’s full-disk encryption technology. In normal business use, it protects the contents of a Windows device by encrypting the drive and tying access to trusted boot conditions, the Trusted Platform Module, recovery keys, and sometimes a pre-boot PIN.

The issue with YellowKey is not that AES encryption has suddenly become useless. The concern is that the recovery pathway around Windows may allow a device to reach a state where protected data becomes accessible without the normal BitLocker recovery key or user password process being enforced as expected. Security researchers and reporting have described this as a bypass involving Windows Recovery Environment behaviour, not as a fundamental break of the encryption algorithm itself.

Microsoft released mitigation guidance for the issue in May 2026, and third-party reporting says the recommended mitigation included changes involving the Windows Recovery Environment and the BootExecute registry value inside the recovery image.

For a business owner or manager, the practical explanation is simple:

If a vulnerable Windows device is lost or stolen, BitLocker may not provide the level of protection you assumed unless mitigations, updates, and device hardening have been properly applied.

That does not mean every Windows laptop is suddenly exposed. It does mean organisations should review their estate quickly and carefully.

Why the BitLocker YellowKey vulnerability matters to small businesses

Small businesses often assume advanced attacks only affect large enterprises, government bodies, banks, or technology companies. In reality, the main risk here is much more ordinary.

A laptop is left in a car.
A staff member loses a device on a train.
A machine is stolen from an office.
A director’s laptop is taken during travel.
An old device is disposed of without proper wipe records.
A failed laptop is sent to a third-party repairer without enough control.

These are not exotic scenarios. They happen every week.

BitLocker is one of the safeguards that reduces the impact of those incidents. If the drive is properly encrypted and the attacker cannot unlock it, the organisation may be able to treat the event as a lost asset rather than an exposed-data event. Depending on the circumstances, that could affect whether the company needs to notify clients, insurers, regulators, or the Information Commissioner’s Office.

That is why the BitLocker YellowKey vulnerability matters. It sits directly in the area where businesses depend on encryption most: protecting data at rest when the physical device is no longer under trusted control.

For small and medium-sized businesses, the most important question is not “Is BitLocker dead?” It is:

Are our laptops configured strongly enough to resist a physical-access bypass, and can we prove it if something goes wrong?

Is BitLocker actually cracked?

The phrase “BitLocker cracked” is attention-grabbing, but it can be misleading.

Based on current public information, YellowKey should not be described as proof that BitLocker’s encryption algorithm has been mathematically broken. The better description is that a security feature bypass affects the trust chain around Windows Recovery Environment and BitLocker-protected data under physical access conditions.

That distinction is important because it affects the response.

If encryption itself were broken, organisations would need to consider replacing the technology entirely. If the issue is a recovery-environment bypass, the immediate response is different: apply Microsoft’s mitigation, review Windows builds, harden device boot controls, consider TPM+PIN for high-risk machines, control recovery keys, and improve physical device security.

Microsoft’s CVE entry and related reporting describe this as a security feature bypass rather than a cryptographic failure.

So, the balanced answer is:

No, BitLocker should not be treated as useless. But yes, the YellowKey issue is serious enough that businesses should review affected Windows devices immediately.

Which systems are reported to be affected?

Public reporting has focused mainly on Windows 11 and recent Windows Server versions. Help Net Security reported that CVE-2026-45585 affects various Windows 11 and Windows Server 2025 versions and requires physical access to a vulnerable device.

Other reporting has noted claims that Windows 10 is not affected in the same way, although businesses should be careful about relying on informal claims without checking Microsoft’s current guidance for their exact build, edition, and update level.

For business purposes, the safer approach is not to argue over headline operating system versions. The safer approach is to inventory devices and check:

Windows version and build
BitLocker status
TPM protector configuration
Whether the device uses TPM-only or TPM+PIN
WinRE status
Recovery key escrow location
Update and mitigation status
Device risk level based on role and data sensitivity

A managing director’s laptop, finance laptop, HR laptop, or device containing client documents should be treated differently from a low-risk kiosk or training machine.

Why “physical access required” should not be dismissed

Some organisations see the phrase “physical access required” and immediately downgrade the risk. That can be a mistake.

Physical access is not rare. It is exactly the situation BitLocker is meant to defend against.

If an attacker needs physical access to exploit a laptop, that may reduce the risk compared with a remote internet-facing vulnerability. But it does not remove the risk. In fact, when the control being attacked is full-disk encryption, physical access is the expected threat model.

BitLocker exists because laptops move. Staff work from home. Devices sit in cars. Engineers visit sites. Sales teams travel. Directors take machines to meetings. Old equipment is stored in cupboards. Failed devices are handled by couriers, suppliers, or repair companies.

A vulnerability that needs physical access may still be highly relevant if your organisation has mobile devices, sensitive data, or regulatory obligations.

The business impact: data protection, insurance, and client trust

For UK businesses, the BitLocker YellowKey vulnerability is not just an IT issue. It has business, legal, and reputational implications.

If a company laptop is stolen and the organisation can show that the device was encrypted, patched, properly managed, and protected by suitable controls, the incident may be easier to contain. If the organisation cannot prove the encryption was effective or cannot locate the recovery key records, the situation becomes more difficult.

The key word is evidence.

Businesses should not only ask whether BitLocker is enabled. They should ask whether they can prove:

The device was encrypted before loss or theft.
The recovery key was stored securely.
The device was patched and managed.
The known mitigation was considered or applied.
The user did not have unnecessary local administrator rights.
The device had appropriate boot and firmware protection.
The business had a response process for lost or stolen equipment.

Cyber insurance providers, auditors, clients, and regulators are increasingly interested in evidence, not assumptions.

A laptop that says “BitLocker on” is not the same as a fully managed, audited encryption posture.

What businesses should do first

The first step is a simple risk review.

Start with mobile Windows devices, especially those used by directors, finance, HR, legal, operations, technical administrators, or staff with access to sensitive client data. These are the machines where a physical-access encryption bypass could have the greatest business impact.

Then check whether your Microsoft 365, Intune, RMM, or endpoint management platform can report BitLocker status across the estate.

At minimum, you want to know:

Which devices are encrypted
Which devices are not encrypted
Which devices have missing recovery keys
Which devices are not checking in
Which devices are running affected Windows builds
Which devices have not received the relevant mitigation
Which devices should be moved to stronger pre-boot protection

If you cannot answer those questions quickly, the YellowKey issue is also exposing a wider asset management problem.

H2: BitLocker YellowKey vulnerability checklist for businesses

The following checklist gives a practical business response without going into exploit instructions.

1. Confirm BitLocker is enabled

Do not assume BitLocker is active because the device is modern, domain joined, or managed. Confirm it.

Many businesses discover that some devices were never encrypted, encryption was suspended during maintenance, or recovery keys were never properly backed up.

2. Check recovery key storage

Recovery keys should be stored in a managed, auditable location such as Microsoft Entra ID, Active Directory, or a properly controlled IT documentation system.

If recovery keys are scattered across emails, screenshots, spreadsheets, paper files, or old ticket notes, that creates its own security problem.

3. Apply Microsoft’s mitigation guidance

Microsoft has published guidance for CVE-2026-45585, and security reporting has noted that Microsoft released mitigation steps and later script-based guidance for the issue.

Businesses should follow Microsoft’s current official guidance, test it carefully, and record which devices have been remediated.

4. Review Windows Recovery Environment

WinRE is useful, but it is also part of the trust boundary. YellowKey has highlighted that recovery tooling should not be ignored during endpoint hardening.

IT teams should check whether WinRE is enabled, whether recovery images are current, and whether Microsoft’s mitigation has been applied correctly.

5. Consider TPM+PIN for higher-risk devices

Many Windows business laptops use TPM-only BitLocker because it is convenient for users. The device boots normally without requiring a pre-boot PIN.

For high-risk users, TPM+PIN may be worth considering. It adds friction, but it can also add protection where physical access risk is higher.

Examples include:

Directors
Finance staff
HR staff
IT administrators
Staff with sensitive client files
Field workers carrying laptops
Staff who travel frequently
Users with access to privileged systems

This does not mean every user must immediately move to TPM+PIN. It means businesses should make a risk-based decision rather than relying on defaults.

6. Lock down firmware and boot options

Attackers with physical access often look for weaknesses in boot order, external media booting, firmware access, recovery tools, and removable device behaviour.

Businesses should review:

BIOS or UEFI passwords
Secure Boot status
External boot permissions
USB boot settings
Firmware update status
Device tamper controls where available

These controls are not a replacement for patching, but they reduce the attack surface around physical access.

7. Improve lost-device procedures

Every business should have a simple lost-device process.

It should answer:

Who does the user contact?
How quickly must they report the loss?
Can IT remotely lock or wipe the device?
Was the device encrypted?
Was the device patched?
What data was accessible?
Does the incident need to be escalated?
Does the organisation need legal, insurance, or ICO advice?

A good lost-device process should be simple enough to follow under pressure.

Why patching alone may not be enough

Patching is essential, but laptop encryption security is broader than Windows Update.

A well-managed endpoint encryption posture includes:

Operating system updates
Firmware updates
Secure Boot
TPM health
BitLocker protector configuration
Recovery key control
Endpoint management
Physical security
User training
Asset inventory
Evidence collection

The YellowKey issue is a reminder that security is often about chains of trust. A weakness in one link can undermine a control that looks strong from the outside.

A device may show as encrypted, but if the recovery environment, boot configuration, or physical boot controls are weak, the real-world risk may be higher than expected.

How this affects Cyber Essentials thinking

For UK businesses working towards Cyber Essentials, encryption is not the only requirement, but device security, secure configuration, access control, malware protection, and update management are all relevant to the wider security posture.

YellowKey is a useful reminder that compliance should not become a tick-box exercise.

A company may say:

“Our laptops are encrypted.”

A stronger answer is:

“Our laptops are encrypted, recovery keys are escrowed, devices are patched, boot options are controlled, high-risk users are reviewed for TPM+PIN, and we can produce evidence from endpoint management.”

That second answer is much more useful in the real world.

For businesses preparing for Cyber Essentials or Cyber Essentials Plus, the YellowKey story is also a good opportunity to review laptop build standards, asset records, encryption policies, local administrator rights, and update reporting.

What should directors and owners ask their IT provider?

Business owners do not need to understand every technical detail of YellowKey. They do need to ask sensible questions.

Here are the questions worth asking:

Are our Windows laptops encrypted with BitLocker?
Can you prove which devices are encrypted?
Are recovery keys stored securely and centrally?
Are any devices missing recovery keys?
Are our Windows 11 devices affected by CVE-2026-45585?
Has Microsoft’s mitigation been applied?
Do any high-risk users need TPM+PIN?
Are boot-from-USB and firmware settings controlled?
What happens if a laptop is stolen?
Can we produce an audit report if requested?

If your provider cannot answer these questions, the problem may not just be YellowKey. The problem may be that device security is not being actively managed.

Practical risk levels

Not every business device carries the same risk.

Lower risk

A fixed desktop in a locked office with limited local data and no access to sensitive systems may be lower risk, especially if it is already patched and physically controlled.

Medium risk

A standard staff laptop used for email, Microsoft 365, Teams, and general client files is a medium risk. It should be encrypted, patched, and managed.

Higher risk

A laptop used by directors, finance staff, HR staff, IT administrators, legal staff, or anyone with large amounts of confidential client data should be treated as higher risk.

Critical risk

A device with cached admin credentials, privileged access tools, customer databases, financial records, HR records, or sensitive project documents should be reviewed urgently.

The more valuable the data, the less acceptable it is to rely purely on default settings.

Recommended action plan for UK businesses

Step 1: Inventory affected devices

List all Windows 11 laptops and any Windows Server systems where BitLocker and recovery environment exposure may be relevant.

Step 2: Check encryption status

Confirm BitLocker is enabled and protecting the operating system drive.

Step 3: Confirm recovery key escrow

Check that recovery keys are stored centrally and can be retrieved by authorised staff only.

Step 4: Apply mitigation

Follow Microsoft’s current CVE-2026-45585 mitigation guidance and record completion.

Step 5: Review high-risk users

Decide whether TPM+PIN is appropriate for directors, finance, HR, IT administrators, and mobile staff.

Step 6: Lock down boot controls

Review BIOS/UEFI passwords, Secure Boot, USB boot, external media boot, and firmware settings.

Step 7: Update your laptop build standard

Make sure new laptops are configured correctly from day one rather than fixed after deployment.

Step 8: Create evidence

Keep records of encryption status, mitigation deployment, recovery key storage, and exceptions.

Step 9: Review lost-device response

Make sure staff know how to report lost or stolen devices quickly.

Step 10: Recheck regularly

Encryption and device security should be reviewed as part of normal endpoint management, not only after a public vulnerability appears.

Common mistakes to avoid

Mistake 1: Assuming BitLocker is enabled everywhere

Many organisations have gaps. Some machines are encrypted, some are not, and some are suspended.

Mistake 2: Treating encryption as a one-time setup

Encryption needs ongoing monitoring. Devices change, updates fail, recovery keys go missing, and policies drift.

Mistake 3: Ignoring physical access attacks

Physical access matters because laptops leave the office.

Mistake 4: Using TPM-only everywhere without review

TPM-only is convenient, but high-risk users may need stronger pre-boot protection.

Mistake 5: Not recording mitigation work

If a laptop is later stolen, “we think it was protected” is not good enough. Record what was done.

Mistake 6: Forgetting old or spare devices

Old laptops in cupboards can still contain sensitive data. They should be encrypted, wiped, or securely destroyed.

Is this a reason to stop using BitLocker?

For most businesses, no.

BitLocker remains a major security control for Windows devices. The wrong reaction would be to abandon encryption or assume there is no point protecting laptops.

The right reaction is to treat BitLocker as one part of a wider endpoint security model.

A strong configuration includes:

BitLocker encryption
Secure recovery key storage
Microsoft patching
Endpoint monitoring
Firmware controls
Secure Boot
Appropriate pre-boot authentication
Staff reporting procedures
Device disposal controls
Regular audits

YellowKey does not remove the need for encryption. It reinforces the need to manage encryption properly.

How Fox Technologies can help

Fox Technologies can help small and medium-sized businesses review Windows laptop encryption, Microsoft 365 device security, Cyber Essentials readiness, and practical endpoint protection.

Useful internal links:

Fox Technologies: https://foxtechnologies.co.uk
Contact Fox Technologies: https://foxtechnologies.co.uk/contact

A practical review can include:

BitLocker status checks
Recovery key audits
Windows 11 device review
Microsoft Intune or RMM reporting
Endpoint hardening
Cyber Essentials preparation
Lost-device response planning
Laptop build standard improvements
Director-friendly security reports

For many businesses, the biggest benefit is not only fixing one vulnerability. It is gaining clear visibility of which devices are protected, which are not, and what evidence exists if something goes wrong.

External reference sources

The following public sources were used to verify the current reporting and technical framing of this article:

Microsoft Security Update Guide entry for CVE-2026-45585.
CVE Record for CVE-2026-45585.
BleepingComputer report on Microsoft mitigation guidance.
Help Net Security report on YellowKey and physical-access requirements.
The Hacker News report on the YellowKey mitigation release and CVSS score.

The BitLocker YellowKey vulnerability is a timely reminder that encryption is not just a checkbox. It depends on the full chain of trust around the device: Windows, recovery tools, firmware, TPM configuration, boot controls, patching, recovery key management, and physical custody.

For UK businesses, the sensible response is not panic. It is verification.

Check which devices are encrypted. Confirm recovery keys are safe. Apply Microsoft’s mitigation. Review high-risk laptops. Strengthen boot controls. Keep evidence. Make sure lost-device procedures are clear.

BitLocker is still valuable, but it should be managed properly. YellowKey shows why assumptions are not enough.

Disclaimer

This article is provided for educational and informational purposes only. While every effort is made to ensure accuracy, cybersecurity threats, regulations, and technologies change regularly. Readers should seek professional advice before implementing security, compliance, or business decisions based on this content. Fox Technologies accepts no liability for actions taken based on this article.