CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Windows CTFMON elevation of privilege (GreenPlasma), CWE-59, CVSS 7.8, fixed in the June 2026 updates

cve · CVE-2026-45586

Coverage
1
first 2026-05-15 → last 2026-10-21
Latest activity
2026-10-21
Leaked BitLocker bypass "YellowKey" and CTFMON privilege escalation "GreenPlasma" were fixed in the June 2026…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
6
4 hosts

Defender insights

What each entry about CVE-2026-45586 tells a defender to do, newest first.

2026-05-15NOTABLELeaked BitLocker bypass "YellowKey" and CTFMON privilege escalation "GreenPlasma" were fixed in the June 2026 updates

Exposure · detection

Story timeline

  1. 2026-05-15Windows BitLocker "YellowKey" (CVE-2026-45585) and CTFMON "GreenPlasma" (CVE-2026-45586) zero-days: public PoCs in May, fixed in the June 2026 Windows updates
    active-threatsLeaked BitLocker bypass "YellowKey" and CTFMON privilege escalation "GreenPlasma" were fixed in the June 2026 updates

Hunting pivots

Affected products
Microsoft Windows 10Microsoft Windows 11Microsoft Windows Server 2012Microsoft Windows Server 2012 R2Microsoft Windows Server 2016Microsoft Windows Server 2019Microsoft Windows Server 2022Microsoft Windows Server 2025
Tags
lpepatch-availablepoc-publicvulnerabilitieszero-day
ATT&CK techniques (3 across 3 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ExecutionCommand and Scripting Interpreter: Windows Command Shell
  • Privilege EscalationExploitation for Privilege Escalation
  • CollectionData from Local System

Execution TA0002

T1059.003Command and Scripting Interpreter: Windows Command Shell×1

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.

Evidence: 2026-05-15/windows-bitlocker-yellowkey-and-ctfmon-greenplasma-zero-days · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-05-15/windows-bitlocker-yellowkey-and-ctfmon-greenplasma-zero-days · ATT&CK page ↗

Collection TA0009

T1005Data from Local System×1

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Evidence: 2026-05-15/windows-bitlocker-yellowkey-and-ctfmon-greenplasma-zero-days · ATT&CK page ↗

Entries about Windows CTFMON elevation of privilege (GreenPlasma), CWE-59, CVSS 7.8, fixed in the June 2026 updates (1)

2026-05-15 · view entry permalink →

NOTABLECVE-2026-45585 +1updatedNATOA1

Windows BitLocker "YellowKey" (CVE-2026-45585) and CTFMON "GreenPlasma" (CVE-2026-45586) zero-days: public PoCs in May, fixed in the June 2026 Windows updates

On 2026-05-13 BleepingComputer and The Register reported that the researcher Nightmare Eclipse (also Chaotic Eclipse) had published exploit code for two Windows zero-days, YellowKey and GreenPlasma (BleepingComputer, 2026-05-13) (The Register, 2026-05-13). The researcher's earlier BlueHammer (CVE-2026-33825) and RedSun drops began to be exploited in the wild shortly after release (BleepingComputer, 2026-05-13).

YellowKey is a BitLocker bypass that needs physical access. The researcher says it affects Windows 11 and Windows Server 2022/2025 and works by placing crafted FsTx files on a USB drive or the EFI partition, rebooting into the Windows Recovery Environment (WinRE) and holding CTRL to trigger a shell (BleepingComputer, 2026-05-13). Will Dormann reproduced it with the files on a USB drive but not on the EFI partition: to boot WinRE, Windows replays the NTFS logs in \System Volume Information\FsTx directories on attached drives, the replay deletes X:\Windows\System32\winpeshl.ini, and WinRE then opens CMD.EXE instead of the recovery environment, with the disk still unlocked (BleepingComputer, 2026-05-13). Because it abuses TPM-only automatic unlock, the public exploit works only on the original device, not on a removed drive, and does not work with TPM+PIN (BleepingComputer, 2026-05-13). Microsoft tracks it as CVE-2026-45585, a security feature bypass by physical attack (CWE-77, CVSS 6.8), publicly disclosed and not exploited; its fixed builds are Windows 11 24H2 build 10.0.26100.8655, 25H2 build 10.0.26200.8655, 26H1 build 10.0.28000.2269 and Windows Server 2025 build 10.0.26100.32995, and its product table does not list Windows Server 2022 (MSRC CVE-2026-45585).

Contradiction: the researcher says an unpublished variant also defeats TPM+PIN (BleepingComputer, 2026-05-13); Microsoft states that "if you are using TPM+PIN the vulnerability is not exploitable" (MSRC CVE-2026-45585).

GreenPlasma is a local privilege escalation in CTFMON: an unprivileged user can create arbitrary memory-section objects within directory objects writable by SYSTEM, and the leaked PoC lacks the component needed for a full SYSTEM shell (BleepingComputer, 2026-05-13); in its current state it triggers a UAC consent prompt in default Windows configurations (The Register, 2026-05-13). Microsoft tracks it as CVE-2026-45586, a link-following flaw (CWE-59, CVSS 7.8) in the Windows Collaborative Translation Framework that lets an authorized local attacker gain SYSTEM privileges, released on 2026-06-09 with fixes for Windows 10, Windows 11 and Windows Server 2012 to 2025, publicly disclosed and not exploited (MSRC CVE-2026-45586).

Windows looks for \System Volume Information\FsTx directories on attached drives, and will replay any NTFS logs.

that the YellowKey exploit worked with the FsTx files on a USB drive but could not reproduce the bug using the EFI partition

BleepingComputer 2026-05-13

No, if you are using TPM+PIN the vulnerability is not exploitable.

Added links to June 2026 Windows security updates.

MSRC CVE-2026-45585 2026-05-19

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

MSRC CVE-2026-45586 2026-06-09

On Tuesday, Microsoft fixed the GreenPlasma, MiniPlasma, and YellowKey security vulnerabilities as part of its June 2026 Patch Tuesday

BleepingComputer (June 2026 fixes) 2026-06-10
Updaterun 2026-05-20-a0f7b07factionscvessourcesbody

Microsoft formally assigned CVE-2026-45585 to the BitLocker / WinRE bypass disclosed by "Nightmare Eclipse" on 2026-05-12 and confirmed there is still no security update. The MSRC update guide entry, published 2026-05-19, classifies it as CWE-77 (command injection in BitLocker / Windows Recovery Environment), CVSS 6.8 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with exploit-code maturity rated E:P (proof-of-concept) and remediation level RL:W (workaround only).

Microsoft's interim mitigation, which it recommends that customers "consider implementing" if they are concerned their devices and data are at risk of being compromised or stolen, is per-device work: mount the WinRE image, remove the autofstx.exe entry from the BootExecute registry value inside the WinRE image, commit the image, then re-establish BitLocker trust for WinRE (MSRC CVE-2026-45585). The MSRC FAQ states: "A successful attacker could bypass the BitLocker Device Encryption feature on the system storage device. An attacker with physical access to the target could exploit this vulnerability to gain access to encrypted data."

A pre-boot PIN avoids depending on the WinRE edit: the public exploit relies on TPM-only automatic unlock and does not work with TPM+PIN (BleepingComputer, 2026-05-13), and NCSC-CH advises that BIOS passwords and a BitLocker PIN mitigate the current public PoC (NCSC-CH Security Hub #12574, 2026-05-14).

Updaterun 2026-10-21T1149Z-auditactionsaffected_productsbodyclassificationcvesentitiesevent_dateevidenceheadlineprioritysectorssourcessummarytagstechniquestitle

Microsoft fixed both flaws in the June 2026 Windows updates of 2026-06-09. Revision 2 of the CVE-2026-45585 record "Added links to June 2026 Windows security updates", with fixed builds Windows 11 24H2 build 10.0.26100.8655, 25H2 build 10.0.26200.8655, 26H1 build 10.0.28000.2269 and Windows Server 2025 build 10.0.26100.32995 (MSRC CVE-2026-45585). GreenPlasma received its own identifier, CVE-2026-45586, released the same day with fixes for Windows 10, Windows 11 and Windows Server 2012 to 2025 (MSRC CVE-2026-45586), and BleepingComputer reported that the June 2026 Patch Tuesday fixed GreenPlasma, MiniPlasma and YellowKey (BleepingComputer, 2026-06-10). Before the fix, on 2026-05-21, Microsoft had replaced its manual WinRE steps with a script that removes autofstx.exe from the WinRE BootExecute value and re-seals WinRE so BitLocker trust remains intact (MSRC CVE-2026-45585). Microsoft marks neither flaw as exploited (MSRC CVE-2026-45585) (MSRC CVE-2026-45586).

threat15 May 05:00Zmulti-sourceOpen finding →
Sources: BleepingComputer · The Register · NCSC-CH Security Hub #12574 · MSRC CVE-2026-45585 · MSRC CVE-2026-45586 · BleepingComputer (June 2026 fixes)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • bleepingcomputer.com2 (33%)
  • msrc.microsoft.com2 (33%)
  • security-hub.ncsc.admin.ch1 (17%)
  • theregister.com1 (17%)

External references

NVD · cve.org · CISA KEV

All cited sources (6)