In June 2026, Microsoft addressed three zero-day vulnerabilities: GreenPlasma (CVE-2026-45586) and MiniPlasma (CVE-2020-17103) are local privilege escalation flaws in the Collaborative Translation Framework (CTFMON) and Cloud Files Mini Filter Driver, respectively, enabling attackers to gain SYSTEM privileges on fully patched Windows systems. YellowKey (CVE-2026-45585) is a backdoor vulnerability in the Windows Recovery Environment (WinRE) that allows attackers with physical access to bypass BitLocker encryption on unpatched Windows 11 and Windows Server 2022/2025 devices. These vulnerabilities were disclosed by a researcher known as "Nightmare Eclipse," who also released proof-of-concept exploits. Microsoft released official patches for all three vulnerabilities in the June 2026 Patch Tuesday update and shared mitigation measures for YellowKey. The vendor criticized the premature public release of proof-of-concept code, which violated coordinated vulnerability disclosure best practices. No active exploitation of these three zero-days has been reported.

Successful exploitation of GreenPlasma and MiniPlasma allows local attackers to escalate privileges to SYSTEM level on fully patched Windows systems, potentially enabling full control over the affected machines. Exploitation of YellowKey enables attackers with physical access to bypass BitLocker encryption on unpatched Windows 11 and Windows Server 2022/2025 systems, compromising the confidentiality of protected data. These vulnerabilities affect system security by enabling privilege escalation and encryption bypass, increasing the risk of unauthorized access and control.

Microsoft has released official patches for GreenPlasma, MiniPlasma, and YellowKey vulnerabilities as part of the June 2026 Patch Tuesday updates. Applying these updates fully mitigates the risks associated with these zero-days. For YellowKey, Microsoft also provided mitigation guidance to defend against potential attacks prior to patching. Users and administrators should prioritize deploying the June 2026 security updates to affected Windows systems. No additional action is required beyond applying the official patches and following vendor guidance.