Full Breakdown
GreatXML: BitLocker Bypass Exploits Windows Defender Offline
6/12/2026, 12:48:04 PM
GreatXML Bypass
On June 10, 2026, security researcher Chaotic Eclipse (aka Nightmare Eclipse) released GreatXML, a proof-of-concept that bypasses BitLocker. The exploit copies unattend.xml and Recovery/WindowsRE/ReAgent.xml to the recovery partition’s root, then forces a restart into WinRE. If the system has previously run a Microsoft Defender Offline scan, a SYSTEM-level shell opens inside encrypted volume.
Context
GreatXML joins a series of zero-day disclosures by Chaotic Eclipse, including YellowKey (CVE-2026-45585), BlueHammer, UnDefend, RedSun, GreenPlasma, MiniPlasma, and RoguePlanet Defender exploit released a day earlier. Microsoft patched those six flaws in the recent Patch Tuesday but has not yet fixed GreatXML. The researcher’s ties with Microsoft soured after Microsoft revoked his MSRC account and called the releases “irresponsible.”
Mechanics & Impact
The exploit leverages XML artifacts left on the recovery partition after a Defender Offline scan. With the two files in place, WinRE parses them and executes malicious code, spawning a SYSTEM-level shell that provides access to the BitLocker volume, nullifying encryption. The attack requires only brief physical access to write the files and impacts any Windows system that has ever run an offline scan.
Criticism
Will Dormann called the write-up “flawed,” noting that a Defender Offline scan needs admin credentials; without them the exploit does not trigger, and an admin can disable BitLocker. He noted that system fails to enter offline-scan mode on three Win11 builds, contradicting the claim that planting the XML files suffices; questions remain about boot paths that induce the state without user interaction.
Official Statements
Microsoft said it is “actively investigating” the RoguePlanet vulnerability but declined to comment on GreatXML or a patch timeline. Company defended coordinated vulnerability disclosure, stating that “this partnership allows us to make updates to impacted services before proof-of-concept code can make it into the hands of bad actors.” It noted earlier flaws (RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, MiniPlasma) were not responsibly disclosed.
Verbatim Quotes
- “This was an accidental discovery, it took a total of 4 hours to find this.” — Chaotic Eclipse, researcher
- “If you ever attempted to use Windows Defender Offline Scan, you're automatically vulnerable to a BitLocker bypass.” — Chaotic Eclipse, researcher
- “And in order to trigger a Microsoft Defender Offline scan, you both need to be logged in to Windows, and also have admin credentials,” — Will Dormann, researcher
- “This partnership allows us to make updates to impacted services before proof-of-concept code can make it into the hands of bad actors.” — Microsoft spokesperson
Outlook
Microsoft has not released a patch for GreatXML and gave no timeline. Chaotic Eclipse said he will not pursue additional trigger methods. Organizations should limit access to recovery partitions, monitor for unauthorized WinRE changes, and consider disabling Defender Offline scans where feasible.
