![\"\"](\"https:\/\/www.newsbeep.com\/us\/wp-content\/uploads\/2026\/06\/windows-bitlocker.jpg\")
<\/a><\/p>\nSecurity researcher Chaotic Eclipse (aka Nightmare-Eclipse and MSNightmare) has released a new Windows BitLocker bypass dubbed GreatXML<\/a>, a day after they published an exploit for Microsoft Defender.<\/p>\n “This was an accidental discovery, it took a total of 4 hours to find this,” the researcher said<\/a> in a post on Blogger. “If you ever attempted to use Windows Defender Offline Scan, you’re automatically vulnerable to a BitLocker bypass. I’m unsure if you can still trigger the bug without ever using the offline scan feature, because you can definitely.”<\/p>\n The exploit works as follows –<\/p>\n Copy an XML file (“unattend.xml”) and a recovery folder containing another XML file (“Recovery\/WindowsRE\/ReAgent.xml) to the root of the recovery partition. If every step is followed correctly, the result is a shell spawned with unrestricted access to the BitLocker volume.<\/p>\n “If Defender offline scan was never initiated then you have to either login and initiate it yourself or figure out a way to boot into WinRE in offline scan state (I believe it should be very possible to do so without logging in) and follow steps above,” Chaotic Eclipse noted.<\/p>\n The release of GreatXML comes not long after RoguePlanet<\/a>, a zero-day flaw in Microsoft Defender that facilitates local privilege escalation (LPE) to SYSTEM, granting the attacker the ability to run arbitrary code or perform unauthorized actions.<\/p>\n GreatXML is also the second BitLocker bypass released by Chaotic Eclipse after YellowKey<\/a> (aka CVE-2026-45585<\/a>), patches for which were released<\/a> by Microsoft this week as part of Patch Tuesday updates.<\/p>\n","protected":false},"excerpt":{"rendered":"\ue804Ravie Lakshmanan\ue802Jun 11, 2026Endpoint Security \/ Vulnerability Security researcher Chaotic Eclipse (aka Nightmare-Eclipse and MSNightmare) has released a…\n","protected":false},"author":2,"featured_media":698604,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[74],"class_list":["post-698603","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/698603","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/comments?post=698603"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/698603\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media\/698604"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media?parent=698603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/categories?post=698603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/tags?post=698603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n Reboot to Windows Recovery Environment (WinRE<\/a>) by holding Shift while clicking Restart in the Windows power menu.<\/p>\n