Unpatched GreatXML exploit bypasses BitLocker on Windows without PIN

Researcher publishes working BitLocker bypass

Security researcher Nightmare-Eclipse, also known as Chaotic Eclipse, published a functional attack tool named GreatXML on GitHub on 11 June 2026. The tool grants access to data on a disk protected by Microsoft BitLocker encryption without requiring the PIN or password. At the time of publication Microsoft had not released a patch and no CVSS severity score had been assigned.

How the exploit works

GreatXML chains two legitimate Windows components: the Windows Recovery Environment (WinRE), which boots when the main operating system fails, and Windows Defender Offline Scan, an antivirus scan that runs outside the primary OS. The attack has a single prerequisite: the target device must have run Windows Defender Offline Scan at least once in the past. If that condition holds, an attacker with physical access copies a specially crafted unattend.xml file to the recovery partition. That file then yields a command prompt with direct access to the otherwise encrypted data, bypassing any PIN or password.

Scope limited to TPM-only configuration

The exploit works only on devices configured with BitLocker in TPM-only mode. A Trusted Platform Module (TPM) is a security chip present in most modern computers; in TPM-only mode BitLocker relies exclusively on that chip and does not prompt the user for a PIN at boot. This is the default setting on many centrally managed corporate workstations, making the vulnerable population large in enterprise environments.

Physical access requirement does not reduce real-world risk

Although the attack requires physical access, that condition occurs in numerous realistic scenarios: lost or stolen employee laptops, devices left unattended in offices, access by maintenance personnel, or physical intrusion into organisational premises. Organisations that depend on BitLocker as their primary protection for data at rest are directly exposed.

EU regulatory frameworks including the NIS2 Directive and the Digital Operational Resilience Act (DORA) obligate organisations to protect sensitive data even when a device is physically compromised. The absence of a patch at the time the exploit was published creates an exposure window that cannot be closed by waiting.

Immediate mitigations while a patch is pending

The only effective defence until Microsoft issues a fix is to enable a PIN at boot in BitLocker management; only TPM-only configurations without that additional factor are vulnerable. Organisations should restrict physical access to devices holding sensitive data and establish clear procedures for lost or stolen equipment. Security teams should monitor advisories from CERT/CC and the Microsoft Security Response Center and deploy any patch immediately upon release. As a temporary measure, consider blocking or auditing WinRE configurations on managed workstations. Finally, conduct an inventory of devices running BitLocker in TPM-only mode and prioritise remediation for those with access to sensitive data.