WinRE Archives

Winsage

June 30, 2026

Windows 11 has three new optional updates worth installing

Microsoft has released three optional updates for Windows 11: KB5095186, KB5095615, and KB5102558. - KB5095186 is for Windows 11 26H1 on Snapdragon X2 systems and upgrades the Windows recovery environment (WinRE) to version 10.0.28000.2335. - KB5095615 also improves the WinRE, updating it to version 10.0.26100.8737. - KB5102558 refines Windows setup binaries and related files for feature updates. These updates can be accessed through Windows Update in the Settings app, and no restart is required after installation.

Winsage

June 28, 2026

Microsoft released Windows 11 KB5102558, KB5095615 Setup and Recovery updates

Microsoft released a preview update identified as C-release under KB5095093, along with new dynamic updates to enhance the Windows experience. Dynamic updates refine the Windows Recovery process and improve the setup experience by updating the Windows Recovery Environment (WinRE) and Setup file binaries. These updates ensure a smoother transition during upgrades and preserve Language Pack (LP) and Features on Demand (FODs) content. The updates include: - KB5095186: Safe OS Dynamic Update for Windows 11, version 26H1, enhancing WinRE to version 10.0.28000.2335. - KB5102558: Setup Dynamic Update for Windows 11, versions 24H2 and 25H2, improving setup binaries and files for feature updates. - KB5095615: Safe OS Dynamic Update for Windows 11, versions 24H2 and 25H2, enhancing WinRE to version 10.0.26100.8737. These updates will be automatically downloaded and installed through the Windows Update channel.

Winsage

June 15, 2026

New Windows Zero‑Day Flaws Target Defender and BitLocker

A cybersecurity researcher known as “Nightmare Eclipse” has revealed two zero-day exploits threatening Windows systems: RoguePlanet and GreatXML. RoguePlanet targets Microsoft Defender, allowing attackers to execute privileged actions and gain SYSTEM-level access on Windows machines. It is a local privilege escalation vulnerability that remains effective on fully updated systems. GreatXML claims to bypass BitLocker disk encryption by manipulating the Windows Recovery Environment, potentially granting access to protected files. However, its effectiveness may be overstated, as it might require administrator-level access. Microsoft advises organizations to implement security updates, treat lost or accessible devices as high-risk, enforce stricter policies, and monitor threat intelligence to mitigate exposure to these vulnerabilities.

Winsage

June 14, 2026

Microsoft released Windows 11 KB5094149 / KB5095971 / KB5094156 Setup, Recovery updates

Microsoft released Patch Tuesday updates KB5094126 and KB5093998 for Windows 11, and KB5094127 for Windows 10. New Dynamic Update packages were introduced to enhance user experience by preserving Language Pack and Features on Demand content during upgrades. The updates include: - KB5095185: Safe OS Dynamic Update for Windows 11, version 26H1, improving WinRE to version 10.0.28000.2269. - KB5094149: Safe OS Dynamic Update for Windows 11, versions 24H2 and 25H2, enhancing WinRE to version 10.0.26100.8655. - KB5095971: Setup Dynamic Update for Windows 11, version 23H2, refining setup binaries for feature updates. - KB5094156: Safe OS Dynamic Update for Windows 11, version 23H2, improving WinRE to version 10.0.22621.7219. - KB5098815: Windows Recovery Environment update for Windows 10, versions 21H2 and 22H2, applying Safe OS Dynamic Update (KB5094154) to WinRE. - KB5094154: Safe OS Dynamic Update for Windows 10, versions 21H2 and 22H2, enhancing WinRE to version 10.0.19041.7417. - KB5094153: Safe OS Dynamic Update for Windows 10, version 1809 and Windows Server 2019, improving WinRE to version 10.0.17763.8880. - KB5094152: Safe OS Dynamic Update for Windows 10, version 1607 and Windows Server 2016, enhancing WinRE to version 10.0.14393.9234. These updates will be automatically downloaded and installed via the Windows Update channel.

Winsage

June 11, 2026

New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files

Security researcher Chaotic Eclipse has released a Windows BitLocker bypass tool named GreatXML, following a previously disclosed exploit targeting Microsoft Defender. The discovery was made accidentally and took four hours. A critical vulnerability exists for users who have used the Windows Defender Offline Scan feature, making them susceptible to the BitLocker bypass. The exploit involves copying an XML file and a recovery folder to the recovery partition and rebooting into the Windows Recovery Environment (WinRE). If the Defender offline scan was not initiated, users must log in to start it or find a way to boot into WinRE in offline scan state. GreatXML is the second BitLocker bypass tool released by Chaotic Eclipse, following the earlier exploit known as YellowKey (CVE-2026-45585), which has been patched by Microsoft.

Winsage

June 11, 2026

Nightmare Eclipse drops claimed BitLocker bypass for Microsoft Windows

Nightmare Eclipse has released a new zero-day vulnerability exploit called GreatXML, which allows unrestricted access to BitLocker volumes on Windows systems that have previously run a Microsoft Defender Offline scan. This discovery was made in four hours and adds to Nightmare Eclipse's total of eight zero-day vulnerabilities. Microsoft is investigating the claims related to another exploit, RoguePlanet, but has not commented on GreatXML or provided a patch timeline. Nightmare Eclipse, rumored to be a former Microsoft employee, has faced backlash from the security community for previous disclosures and has vowed to continue releasing vulnerabilities. Security expert Will Dormann has raised concerns about the practicality of the GreatXML exploit, noting that it requires administrative access and questioning the accuracy of the instructions provided by Nightmare.

Winsage

June 10, 2026

Windows 11’s June update shuts down an intentional BitLocker backdoor with full file access

Microsoft addressed three zero-day vulnerabilities identified by security researcher Nightmare-Eclipse, named YellowKey, GreenPlasma, and MiniPlasma. The YellowKey vulnerability allows access to BitLocker-protected drives on Windows 11 using a USB key, leading to allegations that Microsoft may have left a backdoor in BitLocker. Microsoft implemented a mitigation strategy included in the June 2026 Patch Tuesday updates, which addressed over 200 security flaws. Tensions arose between Microsoft and Nightmare-Eclipse regarding vulnerability reporting protocols and researcher compensation, with Microsoft initially threatening legal action against the researcher. Following backlash, Microsoft retracted the threat but tensions persisted. Nightmare-Eclipse claimed retaliation from Microsoft, including the banning of their GitHub account and deletion of their Microsoft account, which Microsoft denied. The situation highlights the ongoing challenges in cybersecurity and the relationship between tech companies and security researchers.

Winsage

May 25, 2026

Windows zero-days expose gaps in built-in security protections

Two Windows zero-day vulnerabilities, YellowKey and GreenPlasma, have been identified. YellowKey targets the Windows Recovery Environment (WinRE) on Windows 11 and Windows Server 2025, allowing attackers with physical access to bypass BitLocker protections using a USB device. GreenPlasma affects Windows 10, Windows 11, and Windows Server environments with active Collaborative Translation Framework Monitor (CTFMON) sessions, enabling local privilege escalation from a standard user account to SYSTEM-level privileges. Both vulnerabilities require either physical or local access to exploit. Microsoft has not yet released patches for these vulnerabilities, prompting organizations to enhance their security measures and operational resilience. Recommendations include reassessing physical security, limiting local administrative access, and implementing multifactor authentication and robust credential management practices.

Winsage

May 23, 2026

CVE-2026-45585: YellowKey BitLocker Bypass

BitLocker, a security feature for data protection, has a vulnerability identified as CVE-2026-45585, also known as YellowKey, which allows unauthorized access to encrypted data on Windows 11 versions 24H2, 25H2, 26H1, and Windows Server 2025. This flaw does not compromise BitLocker’s encryption but affects the recovery environment supporting it. The vulnerability can be exploited locally through the Windows Recovery Environment (WinRE) by an attacker with physical access, who can trigger an unrestricted shell and access the BitLocker-protected volume. Microsoft has provided two mitigation strategies: modifying the WinRE image to remove the autofstx.exe entry and transitioning from TPM-only protection to a TPM+PIN requirement at startup. The exploit poses challenges for detection, as it occurs pre-boot and currently lacks vendor-published indicators of compromise. Organizations using BitLocker for unattended devices are particularly at risk, as the vulnerability can lead to loss of confidentiality if an attacker gains access before the legitimate user.

Winsage

May 22, 2026

Microsoft says public sharing of Windows 11 vulnerability violates ‘best practices’

A security researcher known as Nightmare-Eclipse revealed a vulnerability in Windows 11, named YellowKey, which allows attackers to access BitLocker-encrypted drives through the Windows Recovery Environment. Microsoft acknowledged the vulnerability, assigned it the identifier CVE-2026-45585, and criticized the public sharing of its proof of concept. Currently, there is no patch available for the BitLocker bypass, but physical access to the device provides some protection. The vulnerability does not exist in Windows 10 due to differences in the Windows Recovery Environment. The attack requires a stolen Windows 11 laptop and a USB stick, and the vulnerable filesystems include NTFS, FAT32, and exFAT. Nightmare-Eclipse speculated that the bypass may function as a backdoor, while Microsoft referred to it as a "security feature bypass vulnerability."