New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files

Security researcher Chaotic Eclipse (aka Nightmare-Eclipse and MSNightmare) has released a new Windows BitLocker bypass exploit named GreatXML, discovered accidentally while researching Microsoft Defender. The exploit works by copying an XML file (unattend.xml) and a recovery folder containing another XML file (Recovery/WindowsRE/ReAgent.xml) to the root of the recovery partition, then rebooting into Windows Recovery Environment (WinRE) by holding Shift while clicking Restart. If successful, the attacker gains a shell with unrestricted access to the BitLocker volume.

The researcher noted that if Microsoft Defender Offline Scan was never initiated, the user must either log in and initiate it or find a way to boot into WinRE in offline scan state without logging in. Security researcher Will Dormann criticized the steps as flawed, stating that triggering a Microsoft Defender Offline Scan requires admin credentials and being logged in, at which point BitLocker can be trivially turned off anyway. Dormann also noted that in his tests on three Windows 11 lineages, the exploit did not automatically trigger offline scan mode after planting the files.

GreatXML follows the recent RoguePlanet zero-day in Microsoft Defender that facilitates local privilege escalation to SYSTEM. It is also the second BitLocker bypass from Chaotic Eclipse after YellowKey (CVE-2026-45585), which Microsoft patched in June 2026 Patch Tuesday updates. Microsoft has acknowledged the report and is actively investigating, emphasizing coordinated vulnerability disclosure.