CVE-2026-45585 is a command injection vulnerability in Microsoft Windows 11 Version 24H2, categorized under CWE-77. It allows improper neutralization of special elements in commands, potentially enabling attackers to bypass security features. The vulnerability is publicly known as 'YellowKey' and a proof of concept has been disclosed outside coordinated vulnerability disclosure timelines. Microsoft has assigned a CVSS v3.1 score of 6.8, reflecting medium severity with high impact on confidentiality, integrity, and availability. Currently, no official patch is released; instead, Microsoft recommends applying workarounds as mitigation until a security update is available. The vulnerability does not affect cloud services and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could lead to full compromise of affected Windows 11 Version 24H2 systems, impacting confidentiality, integrity, and availability. The attack vector requires local access but no privileges or user interaction. The medium severity score reflects the significant potential impact balanced by the limited attack vector. No known active exploitation has been reported.

Microsoft has not yet released an official patch for CVE-2026-45585 but has provided workaround guidance to mitigate the vulnerability until a security update is available. Users and administrators should follow the mitigation steps detailed in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45585. Monitoring the vendor advisory for the release of an official fix is recommended.