Loading story…
Microsoft disclosed multiple security feature bypass vulnerabilities affecting Windows BitLocker and Windows Boot Manager, publishing advisories for CVE-2025-48804, CVE-2025-48001, CVE-2025-55338, and CVE-2022-30203. The BitLocker issues were identified as bypass flaws rather than remote code execution bugs, indicating a risk that attackers could undermine disk encryption protections or related trust controls under certain conditions.
The advisories show a recurring focus on protections tied to the Windows boot chain and full-disk encryption, with three separate BitLocker bypass CVEs and one Boot Manager bypass CVE documented by Microsoft. While Microsoft did not provide public synopses in the referenced notices, the updates signal that organizations relying on BitLocker and secure startup protections should prioritize review and deployment of the relevant Windows security patches to reduce the chance of pre-boot or local protection mechanisms being circumvented.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft released a Security Update Guide entry for CVE-2025-55338, identified as a Windows BitLocker Security Feature Bypass Vulnerability. The reference indicates disclosure in October 2025.
Microsoft published Security Update Guide advisories for two Windows BitLocker Security Feature Bypass Vulnerabilities, CVE-2025-48001 and CVE-2025-48804. Both advisories were released on the same day.
Microsoft released a Security Update Guide entry for CVE-2022-30203, described as a Windows Boot Manager Security Feature Bypass Vulnerability. This is the earliest disclosed event in the provided references.
4 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published Security Update Guide entries for **`CVE-2024-49114`** and **`CVE-2022-21899`**, identifying Windows security weaknesses that could allow a **security feature bypass**. One of the referenced advisories explicitly describes **`CVE-2022-21899`** as a **Windows Extensible Firmware Interface Security Feature Bypass Vulnerability**, pointing to risk in the platform’s boot and firmware trust chain. The available references provide limited technical detail, but both entries indicate Microsoft formally tracked and disclosed the issues through its Security Update Guide and advisory portal. For defenders, the disclosures highlight the need to review Microsoft guidance for affected Windows and firmware-related components, validate patch status, and prioritize systems where bypassing built-in protections could weaken secure boot or other platform security controls.
Jul 12, 2026
Microsoft has published **CVE-2026-50661**, a **Windows BitLocker** security feature bypass caused by **`CWE-693: Protection Mechanism Failure`**. The flaw allows an unauthorized attacker with **physical access** to bypass BitLocker protections on affected Windows systems, including multiple supported builds of **Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025**, before Microsoft’s listed fixed versions. Microsoft scored the issue **CVSS 6.1 (Medium)** and released vendor advisory and patch information through MSRC. If exploited, the weakness could let an attacker recover the **Volume Master Key**, decrypt the full physical volume, and access sensitive data such as user files, system configuration, and active session tokens. The same access could enable offline tampering, including modifying binaries, changing registry hives, or planting persistent malware such as **bootkits** or malicious drivers before the device is returned to service. Reported mitigations include applying Microsoft’s updates, requiring a **pre-boot PIN** for BitLocker, and disabling the Windows Recovery Environment with: ```bash reagentc /disable ```
Jul 15, 2026
Microsoft released security updates for 203 vulnerabilities across its product portfolio, including 33 rated **critical**, and patched six **zero-day** flaws. One of the zero-days, `CVE-2026-42897`, was reported as actively exploited in the wild; it affects **Microsoft Exchange Server** and allows spoofing through an input-sanitization weakness that can trigger JavaScript execution in the **Outlook on the web** context when a crafted email is opened. The update set also addressed multiple Windows zero-days, including the **Windows BitLocker Security Feature Bypass Vulnerability** tracked as `CVE-2026-45585`. According to public reporting, the Windows flaws span components such as **CTFMON**, **HTTP.sys**, **BitLocker**, and the **Cloud Files Mini Filter Driver**, with impacts including privilege escalation, denial of service, security feature bypass, and potential access to encrypted data. Microsoft urged organizations to deploy the patches promptly to reduce exposure.
Jul 24, 2026