Loading story…
Researcher Matt Burch of Atredis Partners disclosed nine vulnerabilities in CryptWare CryptoPro Secure Disk, a Windows full-disk encryption and pre-boot authentication product used in enterprise environments and integrated into some ATM security stacks. The flaws affect pre-boot decryption handling, storage of sensitive key material and configuration data on disk, and Secure Boot implementation, potentially allowing plaintext mounting of encrypted volumes, recovery of decryption keys, and arbitrary Linux execution before the operating system loads.
Burch said the weaknesses could enable ATM jackpotting in some scenarios, but Diebold Nixdorf disputed the practical impact on its ATM deployments. The vendor said it does not use BitLocker, that only two of the nine issues were theoretically applicable to its hard-disk encryption under certain conditions, and that those issues appear to have been addressed in a December 2025 update to components used in its Vynamic Security Suite. Beyond the ATM dispute, the findings highlight broader risk for organizations using CryptoPro across Windows fleets, where poorly protected cryptographic secrets could undermine disk-encryption protections.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The CryptWare CryptoPro Secure Disk vulnerability research was scheduled for presentation at Black Hat USA 2026.
Matt Burch of Atredis Partners disclosed nine vulnerabilities in CryptWare CryptoPro Secure Disk, including weaknesses that could allow plaintext mounting of encrypted volumes, exposure of key material on disk, and arbitrary pre-boot code execution. He said the flaws could potentially enable ATM jackpotting scenarios, while Diebold Nixdorf disputed the practical impact on its ATM deployments.
Diebold Nixdorf said two of the nine CryptWare CryptoPro Secure Disk issues were theoretically applicable to its hard disk encryption under certain conditions and appeared to have been addressed in a December 2025 update.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed multiple **security feature bypass** vulnerabilities affecting **Windows BitLocker** and **Windows Boot Manager**, publishing advisories for `CVE-2025-48804`, `CVE-2025-48001`, `CVE-2025-55338`, and `CVE-2022-30203`. The BitLocker issues were identified as bypass flaws rather than remote code execution bugs, indicating a risk that attackers could undermine disk encryption protections or related trust controls under certain conditions. The advisories show a recurring focus on protections tied to the Windows boot chain and full-disk encryption, with three separate BitLocker bypass CVEs and one Boot Manager bypass CVE documented by Microsoft. While Microsoft did not provide public synopses in the referenced notices, the updates signal that organizations relying on **BitLocker** and secure startup protections should prioritize review and deployment of the relevant Windows security patches to reduce the chance of pre-boot or local protection mechanisms being circumvented.
Jul 12, 2026
Researchers detailed multiple attack paths that can defeat or weaken Microsoft BitLocker on systems using **TPM-only** unlock, showing that physical access remains enough to recover disk encryption keys or bypass pre-boot protections in common configurations. Neodyme revisited the **Bitpixie** technique tied to `CVE-2023-21563`, describing how attackers can downgrade the Windows Boot Manager, abuse a PXE soft-reboot path, and recover the Volume Master Key from memory without the user’s password. A follow-up analysis said Microsoft has struggled to fully close downgrade paths because Secure Boot revocation capacity is limited, older Microsoft-signed bootloaders remain broadly trusted, and stricter PCR bindings have caused recovery and compatibility problems in the field. Separate research from MDSec showed that Dell UEFI firmware can be modified offline at the SPI flash level to disable pre-boot DMA protections while leaving BIOS settings appearing unchanged, enabling follow-on DMA attacks against Windows 11 devices protected by TPM-only BitLocker and, in some cases, privilege escalation even on TPM+PIN systems when the PIN is known. A public GitHub project compiling BitLocker attack techniques further underscored the breadth of the issue, cataloging hardware and software methods ranging from TPM bus sniffing and fTPM glitching to bootloader, WinRE, and recovery-environment flaws across numerous CVEs. Across the disclosures, the consistent mitigation theme was to avoid relying on TPM-only unlock where possible, apply Microsoft’s Secure Boot certificate updates such as **KB5025885**, and require a **pre-boot PIN** to materially raise the bar for physical attackers.
Jul 24, 2026
Microsoft has published **CVE-2026-50661**, a **Windows BitLocker** security feature bypass caused by **`CWE-693: Protection Mechanism Failure`**. The flaw allows an unauthorized attacker with **physical access** to bypass BitLocker protections on affected Windows systems, including multiple supported builds of **Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025**, before Microsoft’s listed fixed versions. Microsoft scored the issue **CVSS 6.1 (Medium)** and released vendor advisory and patch information through MSRC. If exploited, the weakness could let an attacker recover the **Volume Master Key**, decrypt the full physical volume, and access sensitive data such as user files, system configuration, and active session tokens. The same access could enable offline tampering, including modifying binaries, changing registry hives, or planting persistent malware such as **bootkits** or malicious drivers before the device is returned to service. Reported mitigations include applying Microsoft’s updates, requiring a **pre-boot PIN** for BitLocker, and disabling the Windows Recovery Environment with: ```bash reagentc /disable ```
Jul 15, 2026