# WinRE bypass unlocks BitLocker, UEFI passwords

Published: 2026-06-22 · Severity: medium
Canonical: https://vorant.io/reports/a5097a66-54e6-5473-b9c0-2adbcd7913d2/winre-bypass-unlocks-bitlocker-uefi-passwords

> A flaw in Windows Recovery Environment lets attackers with physical access bypass UEFI/BIOS passwords and weaken BitLocker protections.

CERT/CC has published an advisory describing a vulnerability in Microsoft's Windows Recovery Environment (WinRE) that can allow an attacker with physical or administrative access to bypass firmware-level security controls, including administrator-configured UEFI/BIOS passwords. The issue stems from inconsistent enforcement of security checks along WinRE's alternate boot path, and from the unauthenticated nature of the UEFI BootNext NVRAM variable, which takes precedence over the standard BootOrder and is not guaranteed to trigger a full platform reset or re-authentication.

The vulnerability, tracked as CVE-2026-45585, enables so-called 'Evil Maid' attack scenarios in which a brief window of unattended physical access is used to manipulate boot configuration and circumvent pre-boot protections, potentially weakening BitLocker full-disk encryption and exposing sensitive data. The research underlying this advisory draws on work from Eclypsium (referenced as the 'YellowKey' BitLocker bypass). No active exploitation is described in the advisory; this is a disclosed design/implementation weakness with vendor guidance rather than an observed in-the-wild campaign.

CERT/CC and Microsoft recommend that organizations with high-security requirements not rely solely on UEFI/BIOS passwords, and instead disable or restrict WinRE where unnecessary, require ephemeral authorization before invoking recovery, pair BitLocker with TPM+PIN or TPM+Startup Key, restrict NVRAM/ESP modifications, deploy EDR with pre-boot/measured-boot attestation, and enforce physical security controls for high-value devices.

## Mentioned in this report

- Vulnerabilities: CVE-2026-45585

## Detection guidance (public sample)

### BCDEdit Modifying Boot Manager Sequence or Boot Entries

ATT&CK: T1542

Detects bcdedit.exe being used to alter the boot manager's default entry, boot sequence, or timeout - the local mechanism for manipulating BootNext/BootOrder equivalents that CVE-2026-45585 abuses at the firmware layer, and a technique attackers use post-compromise to force boot into WinRE or an alternate OS loader. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: BCDEdit Modifying Boot Manager Sequence or Boot Entries
description: Detects bcdedit.exe invocations that change the default boot entry, one-time
  boot sequence, or bootmgr settings. This is the OS-visible analogue of the unauthenticated
  UEFI BootNext manipulation described in CVE-2026-45585 (WinRE/BitLocker bypass),
  and is also used generically by attackers to force a reboot into WinRE, Safe Mode,
  or an alternate loader for pre-boot tampering.
tags:
- attack.defense-evasion
- attack.t1542
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \bcdedit.exe
    CommandLine|contains:
    - bootsequence
    - /default
    - /set {fwbootmgr}
    - /set {bootmgr}
    - /displayorder
  filter_common_recovery_tools:
    ParentImage|endswith:
    - \TrustedInstaller.exe
    - \MoUsoCoreWorker.exe
  condition: selection and not filter_common_recovery_tools
falsepositives:
- Legitimate dual-boot configuration changes by administrators
- OS deployment / imaging tools (MDT, SCCM) adjusting boot order during provisioning
- Windows Update or feature-update servicing temporarily altering boot entries
level: medium
id: d845ee18-049b-5d7d-9c34-101c2f80ac9b
status: experimental
author: Vorant
```

### ReagentC Used to Disable, Enable, or Boot Into WinRE

ATT&CK: T1542

Detects reagentc.exe invocations that toggle Windows Recovery Environment state or force a one-time boot into WinRE (/boottore), the alternate boot path described in the advisory as inconsistently enforcing pre-boot security checks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ReagentC Used to Disable, Enable, or Boot Into WinRE
description: Detects use of reagentc.exe to disable/enable the Windows Recovery Environment
  or to force an immediate one-time boot into WinRE (/boottore). CVE-2026-45585 highlights
  that WinRE's alternate boot path can bypass firmware-level protections such as UEFI/BIOS
  passwords, making unexpected reagentc activity worth reviewing, especially outside
  planned maintenance windows.
tags:
- attack.defense-evasion
- attack.t1542
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \reagentc.exe
    CommandLine|contains:
    - /boottore
    - /disable
    - /enable
  filter_sccm_imaging:
    ParentImage|endswith:
    - \CcmExec.exe
    - \TSManager.exe
  condition: selection and not filter_sccm_imaging
falsepositives:
- IT staff intentionally disabling WinRE per hardening guidance recommended by CERT/CC
- OS deployment / task sequence tools invoking reagentc during imaging
level: medium
id: 500191c2-8fd1-597e-bc91-1946e198a629
status: experimental
author: Vorant
```

### PowerShell or Command-Line Access to UEFI Firmware Environment Variables

ATT&CK: T1542

Detects use of PowerShell firmware-variable cmdlets or bcdedit's firmware-store option to read/write UEFI NVRAM variables directly, the unauthenticated storage layer (e.g. BootNext) that CVE-2026-45585 exploits to override BootOrder without re-authentication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PowerShell or Command-Line Access to UEFI Firmware Environment Variables
description: Detects PowerShell use of Get-/Set-FirmwareEnvironmentVariable cmdlets,
  or bcdedit targeting the firmware boot manager store, which directly read or write
  UEFI NVRAM variables such as BootNext. The advisory notes these variables are unauthenticated
  and take precedence over BootOrder, enabling pre-boot security bypass; legitimate
  use of these APIs outside firmware tooling/OEM utilities is rare.
tags:
- attack.defense-evasion
- attack.t1542
logsource:
  category: process_creation
  product: windows
detection:
  selection_ps:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains:
    - FirmwareEnvironmentVariable
  selection_bcdedit_store:
    Image|endswith: \bcdedit.exe
    CommandLine|contains: firmware
  condition: 1 of selection_*
falsepositives:
- OEM firmware update utilities or diagnostic tools reading UEFI variables
- Administrative scripts inventorying secure-boot or firmware configuration for compliance
  checks
level: medium
id: 0374827f-4b43-58ec-87ed-f77818394e59
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/226679

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a5097a66-54e6-5473-b9c0-2adbcd7913d2/winre-bypass-unlocks-bitlocker-uefi-passwords.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup