GreatXML is a proof-of-concept exploit that leverages a flaw in Microsoft Defender's offline scan functionality to bypass BitLocker encryption on Windows systems. The exploit requires copying specific XML files to the root of the recovery partition and rebooting the system into Recovery Mode, which then spawns a SYSTEM shell. Systems become vulnerable once an offline scan has been initiated by Defender. The exploit was released by security researcher Nightmare Eclipse and demonstrates a local privilege escalation and encryption bypass without requiring prior authentication. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an attacker with local access to bypass BitLocker encryption and gain SYSTEM-level command prompt access during Recovery Mode. This effectively compromises the confidentiality and integrity of data protected by BitLocker on affected systems. The exploit requires that Defender's offline scan has been run at least once, which is common on many Windows machines. There is no evidence of active exploitation in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider limiting physical and local access to affected systems and avoid initiating Microsoft Defender offline scans unless necessary. Monitor official Microsoft channels for updates and patches addressing this vulnerability.