ExploitPublished 11 Jun 2026

‘GreatXML’ Zero-Day Exploit Bypasses BitLocker

Source SecurityWeek

Severity

High

Rated High by Threat Radar from the SecurityWeek text

Data as of 11 Jun 2026, 15:52 UTC

What to do

AI-suggested

Until an official fix is released, organizations should consider limiting physical and local access to affected systems and avoid initiating Microsoft Defender offline scans unless necessary. Monitor official Microsoft channels for updates and patches addressing this vulnerability.

Description

The PoC exploits Microsoft Defender’s offline scan to spawn a SYSTEM shell when rebooting in Recovery Mode. The post ‘GreatXML’ Zero-Day Exploit Bypasses BitLocker appeared first on SecurityWeek .

Impact

Successful exploitation allows an attacker with local access to bypass BitLocker encryption and gain SYSTEM-level command prompt access during Recovery Mode. This effectively compromises the confidentiality and integrity of data protected by BitLocker on affected systems. The exploit requires that Defender's offline scan has been run at least once, which is common on many Windows machines. There is no evidence of active exploitation in the wild as of the publication date.

Summary

GreatXML is a proof-of-concept exploit that leverages a flaw in Microsoft Defender's offline scan functionality to bypass BitLocker encryption on Windows systems. The exploit requires copying specific XML files to the root of the recovery partition and rebooting the system into Recovery Mode, which then spawns a SYSTEM shell. Systems become vulnerable once an offline scan has been initiated by Defender. The exploit was released by security researcher Nightmare Eclipse and demonstrates a local privilege escalation and encryption bypass without requiring prior authentication.

References

securityweek.com/greatxml-zero-day-exploit-bypasses-bitlocker/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 11 Jun 2026, 09:57 UTC

References

Community reviews