Exploitation observed; activity peaked at 5 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Acceptance of extraneous untrusted data with trusted data in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
DECLINING
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 14 products
| Date | Total | Labels |
|---|
| 2026-05-08 | 3 | Disclosure1Exploit1PoC1 |
| 2026-05-12 | 5 | Active Exploitation1Patch1PoC3 |
| 2026-05-14 | 2 | General1PoC1 |
| 2026-05-15 | 1 | General1 |
| 2026-05-18 | 1 | General1 |
| 2026-09-06 | 1 | Exploit1 |
Bypassing Bitlocker under 5 min using downgrade attack on CVE-2025-48804 https://www.intrinsec.com/en/contournement-bitlocker-la-realite-des-downgrade-attacks/
Post summary
The post announces a quick BitLocker bypass via a downgrade attack against CVE‑2025‑48804, citing an external link that likely contains a PoC; however, no active exploitation, patches, or detailed technical data are provided.
Public PoC Alert: The BitUnlocker Downgrade Attack bypasses BitLocker on patched Windows 11 machines in under 5 minutes. Learn how to secure your TPM with a PIN. #BitLocker #Windows11 #CyberSecurity #InfoSec #BitUnlocker #PoC #GitHub #ZeroDay #TechNews https://securityonline.info/bitunlocker-windows-11-poc-downgrade-attack-cve-2025-48804/ https://t.co/QPlbimmeCd
Post summary
The post announces a public proof‑of‑concept for a downgrade attack that bypasses BitLocker on patched Windows 11, and recommends securing the TPM with a PIN as a workaround.
Downgrade attack for Bitlocker CVE-2025-48804 “July 2025 patch fixes this in bootmgfw.efi, so any pre-patch bootmgfw.efi can be used for a downgrade attack, provided the target does not enforce a boot-manager version (SVN) (which comes with KB5025885).” https://github.com/garatc/BitUnlocker
Post summary
The post announces that a pre‑patch bootmgfw.efi can enable a downgrade attack on BitLocker (CVE‑2025‑48804), highlights that patching in July 2025 (KB5025885) mitigates the risk, and provides a reference to exploit code.
🚨 #CVE-2025-48804 Exposed: How the 'BitUnlocker' Downgrade Attack Shatters #Windows 11 BitLocker Encryption in Under 5 Minutes + Video https://undercodetesting.com/cve-2025-48804-exposed-how-the-bitunlocker-downgrade-attack-shatters-windows-11-bitlocker-encryption-in-under-5-minutes-video/ Educational Purposes!
Post summary
The post highlights a demonstration video showcasing how CVE‑2025‑48804 can be exploited via the BitUnlocker downgrade attack to break Windows 11 BitLocker encryption in under five minutes.
microsoft dropped CVE-2025-48804. an unauth bug, CVSS high, exploit available. if you have microsoft in your stack, block external access to the affected endpoint until patched. #Microsoft #0day #CVE-2025-48804 https://valtikstudios.com/blog
Post summary
Microsoft disclosed CVE-2025‑48804, an unauthenticated vulnerability with a high CVSS score and available exploit; administrators are urged to block affected endpoints until a patch is applied.
Coverage tied to CVE-2025-48804 / WinRE describes boot-chain manipulation where legacy signing trust can keep an old bootmgr story valid.
Post summary
The text briefly references CVE-2025-48804 and hints at boot-chain manipulation via legacy signing trust, but offers no PoC, exploit code, patch, or evidence of active exploitation.
⚠️ BitUnlocker Attack on Windows 11 Allows Access to Encrypted Disks in 5 Minutes Source: https://cybersecuritynews.com/bitunlocker-downgrade-attack-on-windows-11/ @The_Cyber_News The attack is rooted in CVE-2025-48804, one of four critical zero-day vulnerabilities. #ICYMI https://t.co/QQVBzzoB7J
Post summary
The post announces a Windows 11 attack using CVE-2025-48804, highlighting its critical status but lacking any PoC, exploit code, patch information or technical detail.
⚠️ BitUnlocker Attack on Windows 11 Allows Access to Encrypted Disks in 5 Minutes Source: https://cybersecuritynews.com/bitunlocker-downgrade-attack-on-windows-11/ @The_Cyber_News The attack is rooted in CVE-2025-48804, one of four critical zero-day vulnerabilities.
Post summary
The tweet references CVE-2025-48804 as the root of a Windows 11 BitUnlocker attack, but offers no PoC, exploit details, or technical information.
Security Alert — BitLocker Downgrade Attack (CVE-2025-48804) The PoC is publicly available on GitHub. Audit your BitLocker configurations now. https://t.co/ztRzegmLz8
Post summary
The post announces a Proof of Concept for CVE‑2025‑48804, a BitLocker downgrade attack, which is publicly available on GitHub and urges users to audit their BitLocker configurations.
مکانیزم رمزمگاری Bitlocker زیر 5 دقیقه در ویندوز 11 دور زده شد. به تازگی هکرها توانسته اند poc مربوط به آسیب پذیری با کد شناسایی CVE-2025-48804 که مربوط به Bitlocker می باشد را با حمله ای به نام BitUnlocker Downgrade ، ارائه دهند. https://t.co/AINZGyoFnB
Post summary
The post announces a Proof of Concept for CVE‑2025‑48804 with an exploit named BitUnlocker Downgrade and provides a link, but does not discuss patches, active exploitation, or detailed vulnerability specifics.
BREAKING: New BitUnlocker downgrade attack exploits CVE-2025-48804 to bypass Windows 11 BitLocker and decrypt disks with physical access in under 5 minutes. https://threatcluster.io/cluster/new-bitunlocker-attack-compromises-windows-11-disk-encryptio-0f4d968d
Post summary
The post reports that the new BitUnlocker downgrade attack is actively exploiting CVE-2025-48804 to bypass BitLocker on Windows 11, enabling physical‑access decryption in under five minutes.
⏱️ تجاوز BitLocker في أقل من 5 دقائق CVE-2025-48804 – Downgrade Attack في يوليو 2025، فريق Microsoft STORM كشف سلسلة هجوم كاملة ضد BitLocker عبر WinRE. الفكرة: الـ Boot Manager يتحقق من WIM شرعي، لكن عند إضافة WIM ثانٍ داخل SDI بجدول معدل، يتم التحقق من الأول بينما يتم الإقلاع من الثاني (المخترق). 🔎 لماذا الإصلاح غير كافٍ؟ Secure Boot يتحقق من شهادة التوقيع فقط، وليس من الإصدار. أي bootmgfw.efi قديم وموقع بـ PCA 2011 يظل صالحًا، حتى لو كان يحتوي على الثغرة. ⚡ خطوات الهجوم: • وصول فيزيائي إلى الجهاز المستهدف • تحضير BCD معدل يعيد توجيه WinRE إلى SDI مُفخخ • الإقلاع عبر USB أو PXE باستخدام bootmgfw.efi قديم موقع بـ PCA 2011 • تحميل WinRE المخترق دون كشف التلاعب • الـ TPM يفرج عن مفتاح BitLocker بشكل طبيعي • فتح الطرفية مع وحدة OS مفككة التشفير 🛡️ الحماية: • تفعيل BitLocker PIN عند الإقلاع • ترحيل Boot Manager إلى شهادة CA 2023 وإلغاء PCA 2011 عبر KB5025885 • اعتماد SVN (Secure Version Number) لتتبع الإصدارات 🎯 الهدف: جعل الهجوم أسرع وأوضح وأقل تعقيدًا، لكنه يذكّرنا أن الحماية الحقيقية تتطلب أكثر من مجرد تحديثات.
Post summary
The post outlines a full downgrade attack chain against BitLocker (CVE‑2025‑48804), detailing how an attacker can use an old bootloader signed with PCA 2011 to load a compromised WinRE, and it lists remediation steps including a BitLocker PIN, updated boot manager, and disabling the obsolete certificate (KB5025885).
اكتشاف طريقة لتجاوز Bitlocker في أقل من 5 دقائق باستخدام هجوم تخفيض الإصدار على CVE-2025-48804. A method has been discovered to bypass Bitlocker in under 5 minutes using a downgrade attack on CVE-2025-48804. This highlights the importance of staying updated with security patches. https://www.intrinsec.com/en/contournement-bitlocker-la-realite-des-downgrade-attacks/ #CyberSecurity #InfoSec #Vulnerability
Post summary
A new downgrade attack method that can bypass Bitlocker in under five minutes was disclosed for CVE-2025-48804, with a reference link and a reminder to apply patches, but no public exploit code or evidence of active exploitation.
18 of 18 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | microsoft | windows_10_1507 | - | - | x64 |
| OS | microsoft | windows_10_1507 | - | - | x86 |
| OS | microsoft | windows_10_1607 | - | - | x64 |
| OS | microsoft | windows_10_1607 | - | - | x86 |
| OS | microsoft | windows_10_1809 | - | - | x64 |
| OS | microsoft | windows_10_1809 | - | - | x86 |
| OS | microsoft | windows_10_21h2 | - | - | - |
| OS | microsoft | windows_10_22h2 | - | - | - |
| OS | microsoft | windows_11_22h2 | - | - | - |
| OS | microsoft | windows_11_23h2 | - | - | - |
| OS | microsoft | windows_11_24h2 | - | - | - |
| OS | microsoft | windows_server_2012 | - | - | - |
| OS | microsoft | windows_server_2012 | r2 | - | - |
| OS | microsoft | windows_server_2016 | - | - | - |
| OS | microsoft | windows_server_2019 | - | - | - |
| OS | microsoft | windows_server_2022 | - | - | - |
| OS | microsoft | windows_server_2022_23h2 | - | - | - |
| OS | microsoft | windows_server_2025 | - | - | - |