Back Feeds.4Sysops

GreatXML exploit enables BitLocker bypass via recovery partition manipulation

Feeds.4Sysops •IT News • June 11, 2026

A new security vulnerability known as GreatXML allows attackers to bypass BitLocker drive encryption by manipulating files within the Windows recovery partition. The exploit involves placing specific XML files, including an unattended setup file and a recovery configuration file, into the root of the recovery partition. Systems that have previously initiated a Microsoft Defender offline scan are reportedly vulnerable to this attack by default. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GreatXML Zero-Day Exploit Bypasses BitLocker Encryption The GreatXML vulnerability allows attackers to bypass BitLocker drive encryption on Windows systems by manipulating XML files in the recovery partition. Discovered by a researcher known as 'MSNightmare', this zero-day exploit leverages the Windows Defender Offline Scan mechanism, affecting systems that have previously undergone this scan. The exploit requires physical access to the target machine and does not necessitate user login. Security professionals are urged to assess their systems for this vulnerability, as it poses a significant risk to data protection. Currently, there are no patches available, and the exploit remains active in the wild. The vulnerability has raised alarms across the cybersecurity community due to its potential for widespread abuse. 8 sources 64

Extracted Entities

GreatXML exploit enables BitLocker bypass via recovery partition manipulation

The full story

Extracted Entities

Attack Types (1)

Platforms (1)

Vulnerabilities (1)