CVE-2026-45585

This repository describes a BitLocker bypass vulnerability in Windows 11 and Server 2022/2025 via a crafted FsTx folder placed in the System Volume Information directory. The exploit leverages a component in the Windows Recovery Environment (WinRE) to spawn an unrestricted shell, bypassing BitLocker encryption.

The repository claims to be a BitLocker bypass tool but contains no actual exploit code. It directs users to download an external ZIP file, which is a common tactic for distributing malware or fake exploits.

This repository contains a PowerShell script that mitigates CVE-2026-45585 (YellowKey) by adding a TPM+PIN protector to BitLocker-protected drives, preventing the WinRE bypass attack. The script automates the process of setting Group Policy keys, applying them, and adding the TPM+PIN protector.

This repository contains functional PowerShell scripts for detecting and remediating CVE-2026-45585, a vulnerability involving the presence of 'autofstx.exe' in the WinRE BootExecute registry value, which could bypass BitLocker protections. The scripts mount the WinRE image, inspect/modify the offline SYSTEM hive, and ensure proper cleanup.

This repository contains a PowerShell script that automates the mitigation for CVE-2026-45585 by removing 'autofstx.exe' from the BootExecute registry value in the WinRE (Windows Recovery Environment) hive. The script includes verification steps and only commits changes if modifications are necessary.