CVE-2026-45655: Windows BitLocker Auth Bypass Vulnerability

CVE-2026-45655 Overview

CVE-2026-45655 is a protection mechanism failure [CWE-693] in Windows BitLocker. An attacker with physical access to a target device can bypass BitLocker's security feature and read protected data from the encrypted volume. The flaw does not require authentication or user interaction, but the attacker must be physically present at the machine. Microsoft published the advisory on June 9, 2026.

The vulnerability affects the confidentiality of data protected by BitLocker full-volume encryption. Integrity and availability of the host remain intact, since the attack targets disclosure of encrypted contents rather than code execution or system disruption.

Critical Impact
An attacker with physical access can bypass BitLocker and access confidential data on the encrypted volume without valid credentials.

Affected Products

Windows BitLocker (see Microsoft Security Update CVE-2026-45655 for the full list of affected Windows builds)
Windows client and server editions shipping the affected BitLocker component
Devices relying on BitLocker for at-rest disk encryption

Discovery Timeline

2026-06-09 - CVE-2026-45655 published to the National Vulnerability Database
2026-06-09 - Microsoft published security update guidance for CVE-2026-45655
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45655

Vulnerability Analysis

CVE-2026-45655 is categorized as a Protection Mechanism Failure [CWE-693]. BitLocker is intended to keep the contents of a drive confidential when the operating system is offline or the device is lost or stolen. This flaw weakens that protection: an attacker who can touch the hardware can bypass the security feature and obtain access to data that BitLocker is supposed to keep encrypted at rest.

The vulnerability is exploitable only over a physical attack vector. It cannot be triggered remotely or through a network connection, and no privileges or user interaction are required on the target system. The scope is changed, meaning the bypass affects resources beyond the immediate BitLocker component, namely the confidentiality of data stored on the protected volume.

The EPSS probability is 0.076%, reflecting the constrained physical-access prerequisite that makes opportunistic mass exploitation unlikely. Organizations with high-mobility endpoints, traveling executives, or devices stored in untrusted locations remain in scope because lost or stolen hardware is the realistic exploitation scenario.

Root Cause

The root cause is a failure in the BitLocker protection mechanism that allows the security feature to be circumvented under specific physical conditions. Microsoft has not published low-level technical detail in the public advisory. Refer to the Microsoft Security Update CVE-2026-45655 page for the authoritative technical description.

Attack Vector

Exploitation requires direct physical access to a powered-off or unattended device. An attacker can interact with the hardware, boot environment, or storage media to bypass BitLocker enforcement and recover plaintext data from the encrypted volume. The attacker does not need valid credentials on the operating system. No verified public proof-of-concept is currently associated with this CVE.

Detection Methods for CVE-2026-45655

Indicators of Compromise

Unexpected reboots, unscheduled firmware or boot configuration changes, or BitLocker recovery key prompts after physical custody changes
Tamper evidence on chassis, screws, ports, or storage interfaces on affected devices
Devices returning from travel or repair with mismatched TPM measurements or altered boot logs

Detection Strategies

Collect Windows event logs from the Microsoft-Windows-BitLocker channels and the TPM platform validation logs for anomalous state transitions
Monitor for boot configuration data (BCD) changes, Secure Boot policy modifications, and unsigned bootloader components on managed endpoints
Correlate physical custody events such as asset checkouts and travel records with TPM PCR mismatches or BitLocker recovery events

Monitoring Recommendations

Forward BitLocker, TPM, and boot integrity events into a centralized SIEM or data lake for retention and cross-correlation
Alert on repeated BitLocker recovery key prompts across the fleet, which can indicate physical tampering campaigns
Track endpoint health attestation results and flag devices that fail measured boot after being out of the user's possession

How to Mitigate CVE-2026-45655

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-45655 advisory to all affected Windows systems
Prioritize patching for mobile endpoints, kiosk systems, and devices stored in untrusted physical environments
Rotate BitLocker recovery keys for any device suspected of being physically accessed by an unauthorized party

Patch Information

Microsoft has released a security update addressing CVE-2026-45655. Administrators should deploy the corresponding cumulative update for each affected Windows version through Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or their standard patch management workflow. Refer to the Microsoft Security Update CVE-2026-45655 advisory for the build-specific knowledge base articles.

Workarounds

Enable BitLocker pre-boot authentication with a PIN or USB startup key to require an additional secret before the volume is unlocked
Enforce TPM+PIN protectors instead of TPM-only mode on high-risk endpoints to reduce exposure to physical attacks
Ensure Secure Boot, UEFI password protection, and DMA protection (Kernel DMA Protection) are enabled to harden the pre-boot environment
Maintain strict physical custody controls, tamper-evident seals, and chain-of-custody logging for traveling and field-deployed devices

bash

# Enforce TPM+PIN protector and verify BitLocker status on a Windows endpoint
manage-bde -protectors -add C: -TPMAndPIN
manage-bde -status C:

# Confirm Kernel DMA Protection state
powershell -Command "(Get-CimInstance -Namespace root/cimv2/Security/MicrosoftTpm -ClassName Win32_Tpm).IsEnabled_InitialValue; systeminfo | findstr /C:'Kernel DMA Protection'"