GreatXML Windows Zero-Day BitLocker Bypass

In June 2026, a researcher known as MSNightmare (part of the Nightmare-Eclipse cluster) published a proof-of-concept (PoC) exploit named GreatXML. This exploit targets the Windows Recovery Environment (WinRE) and its interaction with Microsoft Defender's Offline Scan feature. By planting a malicious unattend.xml file on the recovery partition, an attacker can gain unauthenticated, unrestricted shell access to BitLocker-encrypted volumes upon reboot.

The attack chain requires prior administrative access to the host to write files to the hidden recovery partition, making GreatXML a post-compromise persistence and data-theft tool rather than an initial access vector. It is particularly dangerous for stolen devices or scenarios where an attacker has achieved temporary local elevation, as the bypass survives credential rotations and standard incident response remediation.

This is the eighth tool released by the Nightmare-Eclipse group in 2026, following other high-profile zero-days such as YellowKey (CVE-2026-45585) and RoguePlanet. The campaign appears specifically designed to systematically dismantle Microsoft's core endpoint security guarantees, including BitLocker, Windows Defender, and the Cloud Files Mini Filter driver.