Summary
Prolific exploit researcher Nightmare Eclipse (also known as Chaotic Eclipse) has publicly released “GreatXML,” a zero-day exploit that bypasses Windows BitLocker encryption by abusing the trust boundary between the main operating system and the Windows Recovery Environment (WinRE). The exploit was disclosed shortly after Microsoft’s record-breaking June 2026 Patch Tuesday and remains unpatched with no CVE assigned.
The attack requires administrator-level access to mount the WinRE partition, where malicious unattend.xml and ReAgent.xml files are planted. After triggering a reboot into WinRE via “Shift + Restart” following a Microsoft Defender Offline scan initiation, the exploit spawns a shell with unrestricted access to the BitLocker-encrypted volume — no recovery key needed.
GreatXML is the second BitLocker bypass from Nightmare Eclipse, following YellowKey (CVE-2026-45585) which was addressed in the June Patch Tuesday. Combined with the previously released RoguePlanet (CVE-2026-50656) Microsoft Defender privilege escalation exploit, Nightmare Eclipse has dropped three Windows zero-days in rapid succession, putting significant pressure on Microsoft’s security response team.
Sources
- ThreatLocker — GreatXML: Exploiting the WinRE Trust Boundary Behind BitLocker
- SecurityWeek — GreatXML Zero-Day Exploit Bypasses BitLocker
- The Hacker News — New GreatXML Exploit Bypasses Windows BitLocker
Commentary
Nightmare Eclipse is having a June to remember — three Windows zero-days in rapid succession, each targeting core security assumptions that enterprises depend on. The GreatXML exploit is particularly concerning for organizations that rely on BitLocker as their primary defense against data theft from lost or stolen devices. While the admin-access prerequisite limits drive-by exploitation, it’s a devastating post-compromise technique: once an attacker has admin, they can plant the payload and maintain persistent access to encrypted data even after credentials are rotated.
Defenders should monitor for indicators including attempts to mount the recovery partition, modifications to unattend.xml or ReAgent.xml in the recovery partition, and Event ID 2030 in Microsoft Defender Operational logs indicating scheduled offline scans. Until Microsoft ships a patch, these detection opportunities are the primary line of defense.