Windows 11 June 2026 Security Alert: Secure Boot Certificate Update and BitLocker Bypass Fix

Microsoft's June 2026 Patch Tuesday delivered one of the most consequential Windows security updates in recent years. KB5094126 — released June 9, 2026 — bundles a long-overdue Secure Boot certificate rotation with a patch for an actively exploited BitLocker bypass vulnerability. If you manage Windows endpoints, this update demands attention beyond your standard patching runbook.

The Secure Boot Certificate Clock Has Run Out

The 2011-era Secure Boot certificates underpinning the Windows trusted boot chain were always time-limited. That time is now up. Microsoft Corporation KEK CA 2011 expires in late June 2026, with additional 2011 certificates expiring through October. With KB5094126, Microsoft automatically migrates eligible devices to the newer 2023 certificate set — but the rollout is phased and not guaranteed to complete on your first update cycle.

The transition does not happen automatically for all devices the moment you push KB5094126. Microsoft uses a phased delivery model based on device health signals — high-confidence devices get the new certificates first. Enterprise environments should monitor completion separately from update compliance.

Administrators can verify certificate status in Windows Security → Device Security. The new 2023 certificates will appear in the Secure Boot database once the migration completes.

CVE-2026-45585: BitLocker Bypass via Windows Recovery Environment

Separate from the certificate work, KB5094126 also patches CVE-2026-45585 — a BitLocker Security Feature Bypass vulnerability rated Important by Microsoft. The CVE allows an attacker with physical access to a target device to bypass BitLocker device encryption and gain access to encrypted data.

How the attack works

The vulnerability exploits the autofstx.exe entry in the BootExecute REG_MULTI_SZ value within the Windows Recovery Environment (WinRE) offline SYSTEM registry hive. Because BootExecute runs before normal OS protections engage, an attacker who boots the device into WinRE can execute arbitrary code in a high-privilege context — effectively bypassing the encryption layer that BitLocker provides.

Who is most at risk

This is a physical access vulnerability. The threat model applies most acutely to:

• Mobile workers carrying laptops to client sites, conferences, or home offices
• Devices in shared or unsecured physical spaces
• Devices sent for repair through third-party channels
• Executives or employees with access to sensitive data on their endpoints

Microsoft explicitly calls out this scenario: "Microsoft recommends considering these mitigations if devices and data are at risk of being compromised or stolen — for example, if employees take their work devices home or on business travel."

Mitigation: interim script + full patch

Microsoft has published a remediation script as an interim measure. The script mounts the WinRE image, loads the offline SYSTEM registry hive, removes autofstx.exe from the BootExecute value, then re-seals WinRE to maintain BitLocker trust chain integrity. Exit code 0 confirms success; exit code 1 indicates a failure requiring manual review.

The permanent fix ships as part of KB5094126. Installing the June 2026 cumulative update is the recommended path. The security update preserves the mitigation behavior post-installation.

What Else Shipped in KB5094126

Beyond security work, KB5094126 also delivers the Low Latency Profile feature — a CPU boost mechanism that momentarily elevates clock speeds in response to shell interactions like Start menu presses and application launches. Microsoft describes this as up to 40% faster perceived response for common tasks.

Note: the Low Latency Profile has a documented conflict on systems with Intel 13th Gen hybrid architectures (such as the i7-13850HX) where efficiency cores can become pinned at 100% utilization. This is resolved by KB5095093. Organizations with fleets of Intel 13th Gen hybrid-core devices should test KB5094126 in a controlled pilot before broad deployment and have the June 23 update ready as a follow-on.

Recommended Deployment Approach

Official Microsoft References

• Microsoft Support — KB5094126 (OS Builds 26200.8655 and 26100.8655) — June 9, 2026
• Microsoft Security Response Center — CVE-2026-45585: Windows BitLocker Security Feature Bypass Vulnerability
• Microsoft Learn — Windows 11 Release Information
• Microsoft Learn — BitLocker Recovery Overview
• Microsoft Learn — Windows 11 version 25H2 Known Issues and Notifications