BitLocker Recovery and Downgrade Flaws Expose Windows Systems to Boot-Time Risk

Microsoft said some Windows Server 2025 devices may enter BitLocker recovery after installing the April 2026 KB5082063 security update, affecting systems with a specific and discouraged BitLocker Group Policy tied to TPM platform validation, PCR7, and Secure Boot conditions during transition to the 2023-signed Windows Boot Manager. The company said the recovery key prompt should typically appear only on the first restart, is preparing a fix, and advised administrators to remove the problematic policy before deployment or use Known Issue Rollback; the issue is mainly expected in enterprise-managed environments rather than personal devices.

Separately, researchers disclosed BitUnlocker, a downgrade attack that can expose data on BitLocker-protected Windows 11 systems in under five minutes with physical access by exploiting CVE-2025-48804 in the Windows Recovery Environment. The attack works because Secure Boot may still trust older Microsoft Windows PCA 2011-signed boot managers, allowing a pre-patch bootmgfw.efi and modified WinRE chain to launch cmd.exe with the encrypted volume already mounted; systems using TPM-only BitLocker remain at risk unless organizations migrate trust to Windows UEFI CA 2023 via KB5025885 or require TPM+PIN pre-boot authentication.