Chaotic Eclipse Strikes Again: New Zero-Day Unlocks BitLocker in Four Hours of Research

A new zero-day vulnerability named GreatXML, disclosed by researcher Chaotic Eclipse, allows bypassing BitLocker encryption on Windows machines that have run Microsoft Defender Offline Scan. The exploit leverages leftover configuration artifacts on the recovery partition processed by Windows Recovery Environment (WinRE) to spawn a SYSTEM-level shell without requiring login. The attack requires brief physical access or the ability to write to the recovery partition. No patch is currently available. Microsoft has criticized the public disclosure as irresponsible and is working on mitigation.

• securityaffairs.com/193516/security/chaotic-eclipse-strikes-again-new-zero-day-unlocks-bitlocker-in-four-hours-of-research.html (opens in a new tab)
• reddit.com/r/cybersecurity/comments/1u2xei3/chaotic_eclipse_strikes_again_new_zeroday_unlocks/ (opens in a new tab)

• Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkNews2026-10-29
• Attackers Exploit Second Cisco Firewall VPN Zero-Day Since AugustHighVulnerability2026-10-29
• Broadcom VMware ESX · Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-DayExploitedVulnerability2026-10-29
• iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18HighVulnerability2026-10-27
• Attackers Exploit Third Arista VCO Zero-Day in Four MonthsCriticalVulnerability2026-10-23