Microsoft Patches YellowKey, GreenPlasma, and MiniPlasma Zero-Days After Public Disclosure Standoff

Microsoft shipped fixes for three actively discussed zero-day vulnerabilities as part of its June 2026 Patch Tuesday release, closing two flaws that hand attackers full SYSTEM privileges on fully updated Windows machines and a third that defeats BitLocker disk encryption when an attacker can physically reach the device.

The three bugs arrived through an unusually public route. A researcher operating under the "Nightmare Eclipse" handle disclosed all of them last month as a protest against how the Microsoft Security Response Center (MSRC) runs its coordinated disclosure process. That backstory matters, because it explains why proof-of-concept code was already circulating before patches existed, and why defenders had to treat these as live threats rather than theoretical ones.

What got fixed

Two of the flaws are local privilege escalation bugs. GreenPlasma (CVE-2026-45586) lives in the Collaborative Translation Framework, the component most Windows users know as CTFMON, the process tied to text input and language services. MiniPlasma (tracked as CVE-2020-17103) sits in the Cloud Files Mini Filter Driver, the kernel-mode component that backs OneDrive's Files On-Demand feature. Both give a local attacker a path to spawn a shell running as SYSTEM, the highest privilege level on a Windows host.

Privilege escalation rarely makes headlines on its own, but it is the quiet workhorse of real intrusions. An attacker who lands on a machine through phishing or a malicious download usually arrives with the limited rights of a standard user. A reliable LPE exploit is what turns that foothold into full control, letting an intruder disable security tools, install drivers, and move laterally. Chaining a browser bug to one of these is a standard pattern, which is why kernel and input-stack flaws like these deserve fast patching.

The third fix addresses YellowKey (CVE-2026-45585), which Microsoft describes as functioning like a backdoor in the Windows Recovery Environment (WinRE). WinRE is the recovery shell that loads when Windows cannot boot normally, and it is supposed to operate inside BitLocker's trust boundary. YellowKey breaks that assumption. An attacker with physical access to an unpatched Windows 11 or Windows Server 2022/2025 system can use it to bypass BitLocker and reach data on encrypted drives.

Why the BitLocker bug stings

BitLocker is the control many organizations lean on for lost or stolen laptops. The promise is straightforward: if the hardware walks out the door, the data stays unreadable. A WinRE-based bypass undercuts that promise for the "evil maid" scenario, where someone gets brief unsupervised access to a powered-off or sleeping device.

Physical-access requirements do lower the practical risk for most enterprises, since this is not something exploited remotely at scale. But for executives traveling with sensitive data, for shared kiosks, and for any environment where devices leave controlled spaces, it is a real exposure. Microsoft published mitigation guidance for YellowKey ahead of and alongside the patch, while also publicly noting that the proof-of-concept had "been made public violating coordinated vulnerability best practices." Organizations that cannot deploy the update immediately should look hard at TPM-plus-PIN configurations, which add a pre-boot secret that a recovery-environment bypass alone does not satisfy.

A disclosure fight in the open

Nightmare Eclipse has been busy. Over recent months the same researcher released proof-of-concept exploits for BlueHammer (CVE-2026-33825) and RedSun, two local privilege escalation zero-days that are now being used in active attacks. The researcher also leaked UnDefend, a bug that lets a standard user block Microsoft Defender definition updates, and on this Patch Tuesday, a Defender zero-day called RoguePlanet that spawns SYSTEM-level command prompts.

Microsoft's response evolved in public view. The company first reacted with threats of legal action, then backtracked after heavy criticism on social media, clarifying it would work with law enforcement only when a researcher "breaks the law and engages in malicious activity causing real harm to our customers." That walk-back is the most telling part of the story for security teams watching how vendor relationships with independent researchers are trending.

The technical takeaway for defenders is harder than usual here, because the disclosure model inverted the normal timeline. Working exploit code circulated before fixes shipped, which compresses the window in which patching is optional. When PoCs are public and some related flaws are already exploited in the wild, the prudent assumption is that attackers have the same code you do.

Practical steps this cycle

Apply the June 2026 cumulative updates across affected Windows 11 and Windows Server 2022/2025 systems, prioritizing internet-facing and high-value hosts for the LPE fixes and mobile or portable devices for YellowKey. For BitLocker specifically, audit whether your fleet relies on TPM-only protection and consider adding a PIN where the threat model includes device theft. Confirm that Microsoft Defender is receiving definition updates, given the separate UnDefend and RoguePlanet issues targeting the antivirus stack itself, since a blinded EDR agent quietly defeats the detection you are counting on.

This batch is also a reminder that detection coverage and patch coverage are different problems. Pushing the update closes the door; verifying that your monitoring would have caught exploitation attempts before the patch is what tells you whether the door was ever watched. Teams that test their SIEM and EDR rules against known techniques, rather than assuming the rules fire, are the ones who find the gaps before an intruder does.