New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files

Ravie LakshmananJun 11, 2026Endpoint Security / Vulnerability

Security researcher Chaotic Eclipse (aka Nightmare-Eclipse and MSNightmare) has released a new Windows BitLocker bypass dubbed GreatXML, a day after they published an exploit for Microsoft Defender.

"This was an accidental discovery, it took a total of 4 hours to find this," the researcher said in a post on Blogger. "If you ever attempted to use Windows Defender Offline Scan, you're automatically vulnerable to a BitLocker bypass. I'm unsure if you can still trigger the bug without ever using the offline scan feature, because you can definitely."

The exploit works as follows -

Copy an XML file ("unattend.xml") and a recovery folder containing another XML file ("Recovery/WindowsRE/ReAgent.xml) to the root of the recovery partition.

Ravie LakshmananJun 11, 2026Endpoint Security / Vulnerability

Security researcher Chaotic Eclipse (aka Nightmare-Eclipse and MSNightmare) has released a new Windows BitLocker bypass dubbed GreatXML, a day after they published an exploit for Microsoft Defender.

The exploit works as follows -

Copy an XML file ("unattend.xml") and a recovery folder containing another XML file ("Recovery/WindowsRE/ReAgent.xml) to the root of the recovery partition.

New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files

New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files

Other newsrooms on this story

Related reading

'GreatXML' Zero-Day Exploit Bypasses BitLocker

Microsoft's worst 'Nightmare' unleashes BitLocker bypass 0-day

Windows vulnerabilities: BitLocker problem and privilege escalation

Windows Zero-Days Expose BitLocker Bypasses And CTFMON Privilege Escalation

Windows BitLocker zero-day gives access to protected drives, PoC released

Zero-day exploit completely defeats default Windows 11 BitLocker protections

Other newsrooms on this story

Related reading

'GreatXML' Zero-Day Exploit Bypasses BitLocker

Microsoft's worst 'Nightmare' unleashes BitLocker bypass 0-day

Windows vulnerabilities: BitLocker problem and privilege escalation

Windows Zero-Days Expose BitLocker Bypasses And CTFMON Privilege Escalation

Windows BitLocker zero-day gives access to protected drives, PoC released

Zero-day exploit completely defeats default Windows 11 BitLocker protections