GreatXML Zero

Gbhackers •Divya • June 11, 2026

A newly disclosed zero-day vulnerability dubbed “GreatXML” is raising serious concerns across the Windows security ecosystem, as it enables a practical BitLocker bypass by abusing the Windows Defender Offline Scan mechanism and Windows Recovery Environment (WinRE). The issue, published by a researcher known as “MSNightmare” (Nightmare Eclipse), demonstrates how systems that have previously initiated a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GreatXML Zero-Day Exploit Bypasses BitLocker Encryption The GreatXML vulnerability allows attackers to bypass BitLocker drive encryption on Windows systems by manipulating XML files in the recovery partition. Discovered by a researcher known as 'MSNightmare', this zero-day exploit leverages the Windows Defender Offline Scan mechanism, affecting systems that have previously undergone this scan. The exploit requires physical access to the target machine and does not necessitate user login. Security professionals are urged to assess their systems for this vulnerability, as it poses a significant risk to data protection. Currently, there are no patches available, and the exploit remains active in the wild. The vulnerability has raised alarms across the cybersecurity community due to its potential for widespread abuse. 8 sources 64

Extracted Entities

GreatXML Zero

The full story

Extracted Entities

Attack Types (1)

Platforms (1)

Tools (1)

Vulnerabilities (1)