Microsoft Patches Three Windows Zero-Days Affecting SYSTEM Access and BitLocker
Summary
Microsoft patched GreenPlasma, MiniPlasma and YellowKey in its June 2026 updates. The flaws can enable local SYSTEM access or, with physical access, bypass BitLocker on affected unpatched systems.
Key points
- GreenPlasma (CVE-2026-45586) and MiniPlasma (CVE-2020-17103) can let local attackers gain SYSTEM privileges on fully patched Windows systems.
- YellowKey (CVE-2026-45585), a Windows Recovery Environment flaw, can bypass BitLocker on affected unpatched Windows 11 and Windows Server 2022/2025 systems when an attacker has physical access.
- Microsoft patched all three vulnerabilities in its June 2026 Patch Tuesday updates.
- Microsoft also shared mitigations for YellowKey and said its proof-of-concept disclosure violated coordinated vulnerability disclosure practices.
- The article attributes disclosure of the three flaws to researcher Nightmare Eclipse; it does not say these flaws were exploited in the wild.
Article Details
- Vulnerability Types
- Local privilege escalation to SYSTEM
- Windows Recovery Environment backdoor enabling BitLocker protection bypass
- Affected Versions
- Windows 11
- Windows Server 2022
- Windows Server 2025
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- available
MITRE ATT&CK
T1059.003 · Windows Command ShellThe RoguePlanet exploit lets threat actors spawn command prompts with SYSTEM privileges.T1068 · Exploitation for Privilege EscalationGreenPlasma and MiniPlasma let local attackers gain SYSTEM privileges on fully patched Windows systems.T1562.001 · Disable or Modify ToolsThe UnDefend zero-day can be exploited to block Microsoft Defender definition updates.
CVE
CVE-2020-17103and “MiniPlasma,” the two privilege escalation vulnerabilities (tracked as CVE-2026-45586 and CVE-2020-17103) were found in the Collaborative Translation Framework (CTFMON) and the Cloud Files Mini FilterCVE-2026-33825Over the past several months, Nightmare Eclipse has released proof-of-concept exploits for BlueHammer (CVE-2026-33825) and RedSun (no identifier), two local privilege escalation (LPE) zero-days which are now activelyCVE-2026-45585The third zero-day patched yesterday is known as YellowKey (tracked as CVE-2026-45585) and acts as a backdoor in the Windows Recovery Environment (WinRE), which is used to repair boot-related issues in Windows.CVE-2026-45586Dubbed “GreenPlasma” and “MiniPlasma,” the two privilege escalation vulnerabilities (tracked as CVE-2026-45586 and CVE-2020-17103) were found in the Collaborative Translation Framework (CTFMON) and the Cloud Files Mini
People
Vendors
Products
BitLockerThe update also fixes YellowKey, a Windows Recovery Environment flaw that can bypass BitLocker protection on affected Windows 11 and Windows Server systems.Microsoft Defender Antimalware PlatformThe researcher also leaked UnDefend, a zero-day that attackers with standard user permissions can exploit to block Microsoft Defender definition updates.Microsoft WindowsMicrosoft patched three Windows zero-days, including GreenPlasma and MiniPlasma, which can give local attackers SYSTEM privileges on fully patched systems.Windows Recovery Environment (WinRE)The third zero-day patched yesterday is known as YellowKey (tracked as CVE-2026-45585) and acts as a backdoor in the Windows Recovery Environment (WinRE), which is used to repair boot-related issues in Windows.