Security researcher Chaotic Eclipse (also known as Nightmare-Eclipse and MSNightmare) has unveiled a new Windows BitLocker bypass called GreatXML, just one day after publishing an exploit targeting Microsoft Defender.
"This was an accidental discovery, it took a total of 4 hours to find this," the researcher stated in a Blogger post. "If you ever attempted to use Windows Defender Offline Scan, you're automatically vulnerable to a BitLocker bypass. I'm unsure if you can still trigger the bug without ever using the offline scan feature, because you can definitely."
The exploit functions as follows:
Place an XML file ("unattend.xml") and a recovery folder containing another XML file ("Recovery/WindowsRE/ReAgent.xml") at the root of the recovery partition.
Boot into the Windows Recovery Environment (WinRE) by holding the Shift key while clicking Restart in the Windows power menu.
If each step is executed correctly, the result is a shell that spawns with unrestricted access to the BitLocker volume.
"If Defender offline scan was never initiated then you have to either login and initiate it yourself or figure out a way to boot into WinRE in offline scan state (I believe it should be very possible to do so without logging in) and follow steps above," Chaotic Eclipse noted.
In a Mastodon post, security researcher Will Dormann described the steps to reproduce GreatXML as "flawed," adding that triggering a Microsoft Defender Offline Scan requires a user to be logged into Windows and possess admin credentials, at which point disabling BitLocker is trivial anyway.
"The writeup for GreatXML suggests that the prerequisite is that Windows Defender Offline has been executed at some point in the past," Dormann added. "And that after planting two files in WinRE, all you need to do is [Shift]-reboot into WinRE, and Windows will automatically go into Microsoft Defender Offline scan mode. But this is not the case in any of the 3 lineages of Win11 that I have handy."
The release of GreatXML follows closely after RoguePlanet, a zero-day vulnerability in Microsoft Defender that enables local privilege escalation (LPE) to SYSTEM, allowing an attacker to execute arbitrary code or perform unauthorized actions.
GreatXML also marks the second BitLocker bypass from Chaotic Eclipse, following YellowKey (also known as CVE-2026-45585), for which Microsoft released patches this week as part of Patch Tuesday updates.