Critical BitLocker Flaw Exploited via Windows Defender Offline Scan

Key Takeaways

• A new zero-day vulnerability, dubbed “GreatXML,” allows for a complete bypass of BitLocker encryption on Windows systems.
• The exploit requires physical access to the target machine and leverages the Windows Defender Offline Scan feature.
• No login credentials are required under specific conditions, making systems that have previously run an offline scan immediately vulnerable.
• The vulnerability affects Windows systems running BitLocker, including Windows 11 24H2, and currently has no official patch.

A critical zero-day vulnerability, named “GreatXML,” has been publicly disclosed, enabling attackers to completely circumvent BitLocker drive encryption on Windows machines. This significant flaw, which necessitates physical access to the target system, exploits a specific interaction with the Windows Defender Offline Scan feature, requiring no user login under certain conditions.

The exploit’s discovery was reportedly accidental, emerging from a research session lasting approximately four hours. A proof-of-concept (PoC) for GreatXML has since been made publicly available across various repositories, increasing the immediate risk.

Understanding the GreatXML BitLocker Bypass

GreatXML functions as a BitLocker security feature bypass, specifically by manipulating the Windows Recovery Environment (WinRE) state initiated by Microsoft Defender’s Offline Scan. When a user or an attacker triggers a Windows Defender Offline Scan, the system reboots into a specialized pre-boot recovery environment to execute the scan.

The vulnerability capitalizes on this transition. If a specially crafted unattend.xml file and a malicious Recovery directory are placed in the root of the recovery partition, and the machine is subsequently rebooted into WinRE, an administrative shell automatically spawns. This shell grants unrestricted access to the BitLocker-protected volume, effectively rendering the encryption useless.

Screenshots accompanying the PoC demonstrate an active X:WindowsSystem32 administrator shell during a Defender Offline Scan session. Commands like manage-bde -status C: confirm that the drive remains 100% encrypted using XTS-AES 128 with a “Protection Status: On,” yet the volume is fully accessible and unlocked, showcasing the complete bypass.

Exploitation Paths and Affected Systems

The GreatXML vulnerability presents two distinct methods for exploitation, depending on the target machine’s prior use of a Defender Offline Scan:

• Automatic Exploitation (No Login Required): If the victim machine has ever initiated a Defender Offline Scan, it becomes immediately vulnerable. An attacker with physical access can simply copy the unattend.xml file and the Recovery directory to the root of the recovery partition. They then reboot the machine into WinRE, typically via the Shift + Restart method, to trigger the exploit.
• Attacker-Initiated Scan Required: If no previous offline scan has been performed, an attacker must either log in to the system to trigger the scan themselves or discover an alternative method to boot the machine into the WinRE offline scan state without authentication. The researcher indicates that this latter method is likely feasible.

This attack model bears a resemblance to the recently patched YellowKey (CVE-2026-45585) BitLocker bypass, which similarly leveraged WinRE to gain access to encrypted volumes through physical interaction.

Any Windows system with BitLocker enabled that has previously utilized or been subjected to a Windows Defender Offline Scan is potentially susceptible to this vulnerability. The attack successfully bypasses BitLocker, even when configured with TPM-only key protection, which typically offers no PIN barrier at boot. The PoC was successfully demonstrated on Windows 10.0.26100.1, corresponding to Windows 11 24H2.

As of this publication, no official patch from Microsoft has been released to address GreatXML. The PoC, developed by a researcher known as NightmareEclipse / MSNightmare, has been disseminated across various platforms, including GitHub and independent Git hosting services.

The public availability of this exploit code significantly lowers the technical barrier for malicious actors. This increases the threat particularly for scenarios involving physical access, such as laptop theft, insider threats, or supply chain compromises, where high-value systems could be targeted.

What You Should Do

• Until an official patch is released, consider disabling the Windows Defender Offline Scan feature on critical systems where physical access is a concern.
• Implement robust physical security measures for all devices, especially laptops and servers, to prevent unauthorized access.
• Monitor for any unusual reboots into the Windows Recovery Environment (WinRE) or unexpected shell access during system startup.
• Regularly back up sensitive data to secure, off-device locations.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.