Unpatched Windows BitLocker bypass and SYSTEM elevation PoCs dropped on GitHub by a disgruntled researcher - YellowKey and GreenPlasma hit Windows 11 and Server 2022/2025

A researcher who calls themselves Chaotic Eclipse - and who has weaponized every prior Windows flaw they have leaked this year - dropped working proof-of-concept code for two unpatched zero-days on May 12. YellowKey lets anyone with physical access to a Windows 11 or Server 2022/2025 machine plug in a USB stick, hold CTRL during a reboot into the Windows Recovery Environment, and get a shell with full access to the BitLocker-protected drive. GreenPlasma is a privilege escalation against the CTFMON service that hands an unprivileged user a path to SYSTEM. Independent researchers including Will Dormann and Kevin Beaumont have confirmed that YellowKey works as advertised.

Check

Inventory which Windows 11, Server 2022, and Server 2025 endpoints have BitLocker in TPM-only mode (the default on most consumer hardware), and identify machines that ever leave secured premises.

Affected

Windows 11 and Windows Server 2022/2025 with BitLocker in TPM-only mode. Windows 10 is unaffected. GreenPlasma privilege escalation hits Windows 11 and Server 2022/2025.

Fix

No patch yet. Switch BitLocker from TPM-only to TPM+PIN, set a BIOS or UEFI admin password, and disable USB boot in firmware. Watch for a Microsoft out-of-band release before next Patch Tuesday.