GreatXML BitLocker Bypass 0

Cybersecuritynews •Guru Baran • June 11, 2026

A newly disclosed zero-day vulnerability, dubbed GreatXML, enables attackers with physical access to fully bypass BitLocker drive encryption on Windows systems by leveraging an obscure but common side effect of Windows Defender Offline Scan, no login required, under certain conditions. The exploit was reportedly discovered accidentally during a roughly four-hour research session and has been […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GreatXML Zero-Day Exploit Bypasses BitLocker Encryption The GreatXML vulnerability allows attackers to bypass BitLocker drive encryption on Windows systems by manipulating XML files in the recovery partition. Discovered by a researcher known as 'MSNightmare', this zero-day exploit leverages the Windows Defender Offline Scan mechanism, affecting systems that have previously undergone this scan. The exploit requires physical access to the target machine and does not necessitate user login. Security professionals are urged to assess their systems for this vulnerability, as it poses a significant risk to data protection. Currently, there are no patches available, and the exploit remains active in the wild. The vulnerability has raised alarms across the cybersecurity community due to its potential for widespread abuse. 8 sources 64

Extracted Entities

GreatXML BitLocker Bypass 0

The full story

Extracted Entities

Attack Types (1)

Platforms (1)

Vulnerabilities (1)