---
title: BitLocker Zero-Day Exploits Leave Windows 11 Systems Exposed
description: Security researcher exposes Windows zero-day exploits, bypassing BitLocker and enabling privilege escalation. Microsoft yet to patch.
canonical_url: https://codekeeper.co/ticker/windows-zero-day-exploits-yellowkey-greenplasma
---

# BitLocker Zero-Day Exploits Leave Windows 11 Systems Exposed

Security researcher exposes Windows zero-day exploits, bypassing BitLocker and enabling privilege escalation. Microsoft yet to patch.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team May 14, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwindows-zero-day-exploits-yellowkey-greenplasma%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwindows-zero-day-exploits-yellowkey-greenplasma%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwindows-zero-day-exploits-yellowkey-greenplasma%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwindows-zero-day-exploits-yellowkey-greenplasma%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwindows-zero-day-exploits-yellowkey-greenplasma%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwindows-zero-day-exploits-yellowkey-greenplasma%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A security researcher released two Windows zero-day exploits on GitHub on May 13, after a dispute with Microsoft over its handling of their earlier reports. The more serious, "YellowKey", uses a crafted folder on a USB stick or the EFI partition to bypass BitLocker on Windows 11 and Server 2022/2025 in minutes — with physical access. The public exploit only works against TPM-only BitLocker, which auto-unlocks at boot; it fails against TPM+PIN. The researcher says he has a version that defeats PIN setups too and is withholding it. Windows 10 is unaffected — its recovery architecture differs. The second exploit, "GreenPlasma", targets the CTFMON service, but the released code is deliberately incomplete — it triggers a UAC prompt by default and lacks the piece needed for a SYSTEM shell. The researcher left that to whoever wants it. Microsoft says it's investigating and hasn't patched either. A BitLocker PIN plus a BIOS password, per Kevin Beaumont, is the practical mitigation. Treat it as urgent: this researcher's April drops, RedSun and UnDefend, were weaponized in real attacks within days, per Huntress. _Updated August 13, 2026: Microsoft patched YellowKey and GreenPlasma on June 9, 2026, in the same Patch Tuesday that fixed the researcher's MiniPlasma flaw._ **Source:** [Cyber Security News](https://cybersecuritynews.com/windows-bitlocker-0-day-vulnerability/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwindows-zero-day-exploits-yellowkey-greenplasma%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwindows-zero-day-exploits-yellowkey-greenplasma%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwindows-zero-day-exploits-yellowkey-greenplasma%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwindows-zero-day-exploits-yellowkey-greenplasma%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwindows-zero-day-exploits-yellowkey-greenplasma%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fwindows-zero-day-exploits-yellowkey-greenplasma%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Malware Linked to Dark Caracal Uses Ethereum as a Backup When Servers Get Taken Down Aug 31, 2026](https://codekeeper.co/ticker/dark-caracal-uses-ethereum-to-sustain-malware)

[174,000 People Affected by Lansing Community College Data Breach Aug 12, 2026](https://codekeeper.co/ticker/lansing-college-data-breach-2025-notification)

[Cyberattacks AI-Made Phishing Decoys Are Hiding Malware in Windows Shortcuts Sep 8, 2026](https://codekeeper.co/ticker/north-korea-kimsuky-ai-phishing-malware)

[Cyberattacks Chrome Zero-Day Exploit Spread to Four Spy Groups Within Days Sep 10, 2026](https://codekeeper.co/ticker/bluemoon-exploit-kit-targets-chrome-windows)