Do Son 
Image: Nightmare-Eclipse
A security researcher recently published a dangerous new exploit. Specifically, the details and proof-of-concept for the GreatXML BitLocker bypass are now publicly disclosed. This severe Windows Defender vulnerability threatens many desktop systems. Furthermore, it allows local attackers to gain full, unrestricted access to encrypted drives.
How the GreatXML Exploit Works
The researcher, known as Nightmare Eclipse, shared the exploit code online. Interestingly, they noted, “This was an accidental discovery, it took a total of 4 hours to find this.” The exploit deliberately manipulates the Windows Defender Offline Scan feature. Consequently, it grants an unrestricted administrative shell.
To execute this attack, a user simply copies specific files. They place “unattend.xml” and a “Recovery” directory into the recovery partition. Next, they reboot the machine directly into WinRE. If successful, “a shell with unrestricted access to the bitlocker volume will spawn.”
Exploitation Requirements
Fortunately, the attack requires very specific conditions. If the victim initiated a Defender offline scan previously, the machine is automatically vulnerable. Alternatively, an attacker must boot into WinRE while in the offline scan state. Therefore, this GreatXML BitLocker bypass poses a significant local physical threat.
Ongoing Microsoft Security Dispute
This release highlights an ongoing, public dispute between the researcher and Microsoft. Previously, Nightmare Eclipse released multiple Windows zero-days. These included the RoguePlanet, BlueHammer, and RedSun flaws. Microsoft recently patched some of these severe issues. They fixed the GreenPlasma and YellowKey bugs during the June 2026 Patch Tuesday updates.
However, Microsoft previously issued stern warnings regarding these disclosures. In fact, they stated they would involve law enforcement if individuals engage in “malicious activity causing real harm to our customers.” Consequently, many cybersecurity experts believed Microsoft was threatening the researcher directly.
Security professionals must remain extremely vigilant. You can review the full proof-of-concept code on GitHub. Additionally, read the researcher’s full breakdown on their blog. Please monitor official Microsoft channels for an incoming security patch.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
