[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4ldvBZoXD0-R38aJFgiKNnPywhADe6T38E68khJiAE8":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"a3ad67cb-40f6-4bd7-a178-c4d15f8520f5","New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files","new-greatxml-exploit-bypasses-windows-bitlocker-via-recovery-partition-xml-files-c11d80","Security researcher Chaotic Eclipse (aka Nightmare-Eclipse and MSNightmare) has released a new Windows BitLocker bypass dubbed GreatXML, a day after they published an exploit for Microsoft Defender. \"This was an accidental discovery, it took a total of 4 hours to find this,\" the researcher said in a post on Blogger. \"If you ever attempted to use Windows Defender Offline Scan, you're","Security researcher Chaotic Eclipse has released a new exploit named GreatXML that bypasses Windows BitLocker encryption. The exploit involves placing specific XML files on the recovery partition and rebooting into the Windows Recovery Environment (WinRE) to gain unrestricted access to the BitLocker volume. This bypass is reportedly triggered if Windows Defender Offline Scan has been used, or can be manually initiated.","New GreatXML exploit bypasses Windows BitLocker via recovery partition XML files.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fnew-greatxml-exploit-bypasses-windows.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhqKyNLbT9WYm7m6ZsvIgv0mNbGJCrgEjUUXLbRZV9mmQUVi7jT9IiwlXh2kYKiMOrsCnJ-ZaoAK9GnL9jy6RHJELISIGFuLSZgsSYuclWFcPmItYL04pTVeA7cl_jy8L6RU4CVPypa6u24OH8hCwPL1g1tEVRczTV1YjZ5KUFGZc6DVw8Pdo_CFGXRTS-d\u002Fs1600\u002Fwindows-bitlocker.jpg","2026-06-11T17:43:52+00:00","2026-06-11T20:00:31.808783+00:00",8,[17,20,22,24,27,29],{"name":18,"type":19},"Chaotic Eclipse","threat_actor",{"name":21,"type":19},"Nightmare-Eclipse",{"name":23,"type":19},"MSNightmare",{"name":25,"type":26},"Windows BitLocker","product",{"name":28,"type":26},"Microsoft Defender",{"name":30,"type":31},"Windows Recovery Environment","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,40],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[25,28],{"controls":48,"vendors":135},[49,77,106],{"slug":50,"name":51,"problem":52,"products":53},"patch-management","Automated patch management","Known holes get closed in days, not months.",[54,62,69],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":50,"product_name":66,"url":67,"description":68},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":78,"name":79,"problem":80,"products":81},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":107,"name":108,"problem":109,"products":110},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",[136],{"slug":137,"name":138,"logo_path":139,"roles":140},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[141],"affected",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":152},"greatxml-exploit-bypasses-bitlocker-through-recovery-partition-manipulation","GreatXML Exploit Bypasses BitLocker Through Recovery Partition Manipulation","The GreatXML exploit demonstrates a critical flaw in Windows BitLocker's security model by manipulating XML files in the recovery partition to bypass full disk encryption. This attack vector exploits the trust relationship between the Windows Recovery Environment (WinRE) and BitLocker, allowing attackers with physical access to gain unrestricted access to encrypted volumes. The vulnerability is particularly concerning because it can be triggered through legitimate Windows Defender Offline Scan operations or manual initiation, making it both stealthy and accessible to attackers. This highlights the importance of comprehensive encryption strategies that consider all system components, not just the primary operating system.",[147,148,149,150,151],"NIST SP 800-111","CIS Control 3.3","CIS Control 8.1","NIST SC-28","ISO 27001 A.10.1.1",{}]