Theregister New Windows Zero-Day Vulnerabilities: YellowKey and GreenPlasma Exploits Released
Article Content
- •Nightmare-Eclipse disclosed two zero-day vulnerabilities: YellowKey and GreenPlasma.
- •YellowKey allows bypassing BitLocker encryption, providing unrestricted access to protected drives.
- •GreenPlasma enables local privilege escalation to SYSTEM privileges, posing significant risks.
Security researcher Nightmare-Eclipse has disclosed two critical zero-day vulnerabilities affecting Windows 11 and Windows Server 2022/2025. The first, YellowKey, allows attackers to bypass BitLocker encryption, granting unrestricted access to protected drives by exploiting the Windows Recovery Environment. The second, GreenPlasma, is a privilege escalation flaw that enables local users to gain SYSTEM privileges by manipulating the CTFMON process. Both vulnerabilities were released shortly after Microsoft's Patch Tuesday updates, raising concerns about their potential exploitation in the wild. The researcher claims that YellowKey functions like a backdoor, as it relies on a component found only in the recovery environment. The vulnerabilities affect systems that utilize BitLocker for encryption, particularly in enterprise settings. Currently, there are no official patches or mitigations from Microsoft for these vulnerabilities.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (43)
Following this threat?
Track Microsoft and CVE-2026-32201 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Warlock Ransomware Targets Critical Infrastructure in Spanish and Portuguese Regions The Warlock ransomware group, tracked as Longlegs or Storm-2603, has targeted critical infrastructure in Portuguese- and Spanish-speaking countries, including a water utility, a telecommunications provider, a regional government body, and an university. Recent attacks exploited vulnerabilities in Microsoft SharePoint… 
New BigDiskBuster Zero-Day Blocks Microsoft Defender Updates Security researcher Abdelhamid Naceri, known as NightmareEclipse, released a proof-of-concept tool named BigDiskBuster that prevents Microsoft Defender from installing critical updates. This zero-day vulnerability affects all supported versions of Windows by filling disk space to block update processes. The tool does…