Microsoft Resolves BitLocker Recovery Bug in Windows Server 2025

Feeds.4Sysops

Microsoft Resolves BitLocker Recovery Bug in Windows Server 2025

First seen 11 Jun 2026, 10:43 UTC • •27.9

Article Content

1 / 3

Browse articles

ThreatCluster •June 12, 2026 at 10:38 UTC

•Microsoft resolved a BitLocker recovery issue affecting Windows Server 2025 and Windows 11.
•The bug was triggered by specific Group Policy configurations involving TPM and PCR7.
•Cumulative updates KB5094125 and KB5093998 were released to fix the issue.

Microsoft has fixed a bug affecting Windows Server 2025 and Windows 11 systems that caused them to enter BitLocker recovery mode after installing security updates. The issue was linked to specific Group Policy configurations involving Trusted Platform Module (TPM) validation profiles, particularly with PCR7 settings. Affected devices prompted users for a recovery key immediately following the installation of updates that modified boot files. Microsoft acknowledged the issue after the April 2026 Patch Tuesday and released cumulative updates to address it. The updates were included in KB5094125 for Windows Server 2025 and KB5093998 for Windows 11 23H2. IT administrators were advised to adjust Group Policy settings or apply a Known Issue Rollback if they could not deploy the updates immediately. The bug primarily impacted enterprise systems rather than personal devices. The resolution aims to prevent unexpected recovery prompts during system restarts.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 91d ago How this analysis works

Timeline

2026-04-11

Issue acknowledged after April 2026 Patch Tuesday

Microsoft confirmed that some Windows Server 2025 devices entered BitLocker recovery after installing updates.

BleepingComputer

2026-06-11

Cumulative updates released to resolve BitLocker recovery bug

Microsoft released KB5094125 and KB5093998 to address the BitLocker recovery issue on affected systems.

More articles in this cluster (2)

Threat Graph

2 entities, 1 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Affected Platform (2)

Windows 11
Windows Server 2025

Relationships

Windows 11 related to Windows Server 2025

Continue Reading

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…

Critical GitLab Vulnerabilities Exploited Within Hours of Disclosure On September 10, 2026, GitLab released patches for critical vulnerabilities CVE-2026-85706 and CVE-2026-87719. CVE-2026-85706, a path traversal flaw, allows unauthenticated users to read arbitrary files from GitLab servers, while CVE-2026-87719 enables credential theft via insecure deserialization. Both…