CVE-2026-45585 (YellowKey) is a Windows Hello credential extraction vulnerability that exploits the gap between hardware-attested authentication and fallback unlock paths. Microsoft has explicitly confirmed that the TPM+PIN configuration renders this vulnerability non-exploitable — this is the critical mitigation detail that defines the entire threat model.
If your Windows 11 24H2 devices use Windows Hello with biometric-only unlock or PIN without TPM binding, they are vulnerable. The attack works offline against a device in an attacker’s possession, extracting or replaying credentials that sit behind the Hello unlock gate. Microsoft’s travel advisory confirms this is a physical-access scenario, but understand the real blast radius: those extracted credentials feed into Windows’ broader authentication subsystem, including cached credential stores and potentially cloud-joined resources. This is not just local device access — it's credential harvesting that can enable lateral movement.
The fact that Microsoft will 'maintain the mitigation's behavior' in the security update is significant. They are not patching a conditional branch — they are permanently restructuring the credential validation flow, likely moving TPM seal verification earlier in the unlock sequence or making it a prerequisite rather than a parallel check. This tells you the vulnerable pathway was architectural, not incidental. The default Hello configuration shipped with Windows 11 24H2 was, in Microsoft’s own post-disclosure framing, unacceptable.
Your immediate actions: verify that all managed Windows 11 24H2 devices enforce TPM+PIN for Windows Hello, not biometric-only or PIN-only. Treat unpatched devices in the field as credential-theft vectors — if one is stolen, assume the credentials it caches are compromised and rotate them. The public PoC means this is an active exploitation window; prioritize patch deployment and device inventory verification now.