Executive Summary
A critical zero-day vulnerability named 'GreatXML' has been disclosed that allows attackers with physical access to bypass BitLocker drive encryption. The exploit targets the Windows Recovery Environment (WinRE) during a Windows Defender Offline Scan. By placing a malicious 'unattend.xml' file in the recovery partition, an attacker can trigger an administrative command shell that has full, unauthenticated access to the encrypted volume.
The vulnerability is particularly dangerous because it affects systems even if BitLocker is reported as '100% Encrypted' and 'Protection On.' If a machine has ever performed a Defender Offline Scan in its history, it may be permanently susceptible to this bypass without requiring any user credentials. This vulnerability mirrors the attack pattern of CVE-2026-45585 (YellowKey).
This flaw represents a significant risk for lost or stolen laptops and insider threats. Currently, no official patch from Microsoft is available. Security teams are advised to move away from TPM-only BitLocker configurations and implement TPM+PIN requirements to mitigate this pre-boot environment exploit.