🔑 CVE-2026-45585 - YellowKey 🔓

Advanced mitigation for CVE-2026-45585 (YellowKey)

📌 What is YellowKey Vulnerability?

YellowKey (CVE-2026-45585) is a zero-day physical attack vulnerability discovered in May 2026 that allows attackers with physical access to completely bypass BitLocker encryption on Windows 11 devices — without needing the PIN, password, or recovery key.

How the Attack Works:

• Attacker boots the device into WinRE (Windows Recovery Environment)
• Uses a specially crafted USB with NTFS transaction logs (FsTx)
• Exploits autofstx.exe to gain an elevated Command Prompt
• BitLocker is automatically unlocked by TPM → full access to the drive

Affected Systems: Windows 11, Windows Server 2022/2025
Not Affected: Windows 10

✨ Script Features

• Complete Mitigation: Applies both official fixes
• WinRE Hardening: Removes autofstx.exe from BootExecute (Primary fix)
• TPM+PIN Enforcement: Adds strong PIN protector to BitLocker
• Smart Detection: Only processes protected drives with TPM
• Safe & Reversible: Clean logic with user confirmation
• Beautiful Output: Color-coded, professional console experience

🚀 How to Use

1. Download the Script

Save the script as Mitigate-YellowKey.ps1

2. Run as Administrator

# Full mitigation (Recommended)
.\Mitigate-YellowKey.ps1

# Only WinRE fix
.\Mitigate-YellowKey.ps1 -SkipTPMPIN

# Only TPM+PIN (specific drive)
.\Mitigate-YellowKey.ps1 -Drive "C:" -SkipWinRE

⚙️ Parameters

🛡️ Security Recommendations

• Use TPM + PIN (6+ characters, preferably alphanumeric)
• Enable Secure Boot
• Keep physical access controlled
• Reboot after running the script
• Verify with: manage-bde -status

⚠️ Important Notes

• After adding TPM+PIN, you will need to enter the PIN at every boot.
• Always backup important data before running.
• This script is custom-made based on Microsoft's official guidance.
• Run on Windows 11 only.