Microsoft patches three Windows zero-days including BitLocker bypass

Microsoft has fixed three zero-day vulnerabilities as part of its June 2026 Patch Tuesday updates. Two allow local attackers to gain SYSTEM privileges on fully patched Windows systems. The third grants access to BitLocker-protected drives.

GreenPlasma and MiniPlasma enable SYSTEM-level privilege escalation. GreenPlasma, tracked as CVE-2026-45586, resides in the Collaborative Translation Framework (CTFMON). MiniPlasma, tracked as CVE-2020-17103, affects the Cloud Files Mini Filter Driver.

Both flaws let local attackers obtain a shell with SYSTEM permissions on fully patched Windows systems. Security researcher "Nightmare Eclipse" disclosed them last month.

YellowKey functions as a backdoor in Windows Recovery Environment. Tracked as CVE-2026-45585, YellowKey allows attackers with physical access to bypass BitLocker protection. It impacts unpatched Windows 11 and Windows Server 2022/2025 systems.

Microsoft shared mitigation measures for YellowKey to defend against in-the-wild attacks. The company complained that the proof-of-concept had been made public, violating coordinated vulnerability best practices.

Nightmare Eclipse disclosed the flaws in protest over MSRC practices. The researcher released the three zero-days last month to protest how the Microsoft Security Response Center handles the disclosure process. Microsoft initially reacted to these and prior leaks with threats of legal action.

The company later backtracked following massive blowback on social media. It said it would work with law enforcement when security researchers break the law and engage in malicious activity causing real harm to customers.

Additional zero-days from the same researcher are already exploited. Over the past several months, Nightmare Eclipse released proof-of-concept exploits for BlueHammer (CVE-2026-33825) and RedSun. These local privilege escalation zero-days are now actively exploited in attacks.

The researcher also leaked UnDefend, which lets standard user accounts block Microsoft Defender definition updates. On Tuesday, another Microsoft Defender zero-day named RoguePlanet was disclosed, allowing threat actors to spawn command prompts with SYSTEM privileges.