Loading story…
Microsoft has announced a new hardware-accelerated BitLocker encryption feature for Windows 11 and Windows Server, designed to address performance bottlenecks caused by traditional software-based encryption on high-speed NVMe drives. By offloading encryption and decryption tasks to dedicated cryptographic engines within modern CPUs or system-on-chip (SoC) processors, the new approach significantly reduces CPU overhead, improves storage performance, and enhances battery life for intensive workloads such as gaming and video editing. The updated BitLocker implementation also introduces hardware-protected keys and defaults to the robust XTS-AES-256 algorithm on supported hardware, with administrative tools updated to detect and report this mode.
Previously, Microsoft had forced software-based BitLocker encryption by default on new Windows 11 Pro installations, which could reduce SSD performance by up to 45% and negatively impact battery life. The new hardware-accelerated solution, first announced at Ignite 2025, is available in the latest Windows 11 (25H2) and Windows Server (2025 September Update) releases, but requires upcoming CPUs with built-in cryptography accelerators that are not yet widely available. This change is expected to nearly double storage performance in some scenarios and aligns with industry trends toward leveraging hardware-based security features for both performance and protection.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft announced a new hardware-accelerated BitLocker implementation for Windows 11 and Windows Server 2025 that offloads encryption work to dedicated cryptographic hardware on supported SoCs. The company said the change is intended to reduce the storage-performance penalties and CPU overhead of software-based BitLocker while improving battery life and key protection.
On supported devices, Microsoft said hardware-accelerated BitLocker is enabled by default beginning with the September 2025 Windows 11 24H2 and 25H2 updates. Initial support is tied to Intel vPro systems using future Core Ultra Series 3 processors, with broader platform support planned later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft said some **Windows Server 2025** devices may enter **BitLocker recovery** after installing the April 2026 `KB5082063` security update, affecting systems with a specific and discouraged BitLocker Group Policy tied to TPM platform validation, PCR7, and Secure Boot conditions during transition to the **2023-signed Windows Boot Manager**. The company said the recovery key prompt should typically appear only on the first restart, is preparing a fix, and advised administrators to remove the problematic policy before deployment or use **Known Issue Rollback**; the issue is mainly expected in enterprise-managed environments rather than personal devices. Separately, researchers disclosed **BitUnlocker**, a downgrade attack that can expose data on BitLocker-protected **Windows 11** systems in under five minutes with physical access by exploiting `CVE-2025-48804` in the Windows Recovery Environment. The attack works because Secure Boot may still trust older **Microsoft Windows PCA 2011**-signed boot managers, allowing a pre-patch `bootmgfw.efi` and modified WinRE chain to launch `cmd.exe` with the encrypted volume already mounted; systems using **TPM-only** BitLocker remain at risk unless organizations migrate trust to **Windows UEFI CA 2023** via `KB5025885` or require **TPM+PIN** pre-boot authentication.
Jun 29, 2026
Microsoft has published **CVE-2026-50661**, a **Windows BitLocker** security feature bypass caused by **`CWE-693: Protection Mechanism Failure`**. The flaw allows an unauthorized attacker with **physical access** to bypass BitLocker protections on affected Windows systems, including multiple supported builds of **Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025**, before Microsoft’s listed fixed versions. Microsoft scored the issue **CVSS 6.1 (Medium)** and released vendor advisory and patch information through MSRC. If exploited, the weakness could let an attacker recover the **Volume Master Key**, decrypt the full physical volume, and access sensitive data such as user files, system configuration, and active session tokens. The same access could enable offline tampering, including modifying binaries, changing registry hives, or planting persistent malware such as **bootkits** or malicious drivers before the device is returned to service. Reported mitigations include applying Microsoft’s updates, requiring a **pre-boot PIN** for BitLocker, and disabling the Windows Recovery Environment with: ```bash reagentc /disable ```
Jul 15, 2026
Microsoft released mandatory Windows 11 cumulative updates **KB5083769** for versions **25H2/24H2** and **KB5082052** for **23H2**, delivering April Patch Tuesday security fixes alongside reliability and feature improvements. The `25H2` and `24H2` releases share the same changes because both are based on `24H2`, and the update moves those branches to builds **26200.8246** and **26100.8246**. Microsoft said the packages include protections against phishing through malicious **`.rdp`** files, Secure Boot certificate management improvements, and a fix for an issue that had pushed some systems into **BitLocker Recovery** after Secure Boot updates; the release also bundles servicing stack update **KB5088467**.
Jun 29, 2026