Security researcher “Nightmare Eclipse” has released a zero-day exploit dubbed “GreatXML” that bypasses Microsoft’s BitLocker full-disk encryption and spawns a command prompt with SYSTEM privileges in Recovery Mode. The exploit targets a vulnerability in Microsoft Defender’s offline scan functionality, and the researcher claims that any Windows system that has initiated an offline scan at least once is vulnerable.
The timing is particularly unfortunate for Microsoft, coming just days after the company’s record-breaking June 2026 Patch Tuesday that addressed 206 vulnerabilities including 33 critical flaws. GreatXML was not among them. The exploit chain leverages the offline scan mechanism to break out of the Windows Recovery Environment and gain full system access, effectively rendering BitLocker’s encryption protections moot for an attacker with physical access to the device.
Microsoft has not yet issued a CVE or advisory for the GreatXML vulnerability. No patch is currently available.
Sources
- SecurityWeek — GreatXML zero-day exploit bypasses BitLocker
- CISO Series — Nightmare Eclipse drops Windows zero-day
Commentary
BitLocker bypasses are always high-impact because organizations rely on full-disk encryption as a foundational control for endpoint security, especially for lost or stolen devices. The “physical access required” caveat reduces the attack surface somewhat, but it’s cold comfort for enterprises with thousands of laptops in the field, shared workstations, or devices in supply chain transit.
The fact that the trigger condition is simply “has ever run an offline scan” means the vulnerable population is enormous. Microsoft Defender’s offline scan is a commonly recommended remediation step for stubborn malware — meaning the very act of trying to clean a system may have introduced this vulnerability. Microsoft needs to move quickly on a patch, and in the interim, organizations should evaluate whether disabling the offline scan feature is a viable stopgap.