GreatXML bypasses Windows BitLocker via WinRE
A researcher disclosed GreatXML, a BitLocker bypass triggered by copying XML files to the recovery partition and booting into Windows Recovery Environment, granting unrestricted volume access.
Sourcethehackernews.com — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Security researcher Chaotic Eclipse has released GreatXML, a new Windows BitLocker bypass vulnerability discovered accidentally within four hours. The exploit targets systems where Windows Defender Offline Scan has been used at least once, though the researcher suggests the vulnerability may be triggerable without prior use of that feature.
The attack vector involves placing specially crafted XML files (unattend.xml and Recovery/WindowsRE/ReAgent.xml) in the recovery partition's root directory, then rebooting into Windows Recovery Environment by holding Shift during restart. When executed correctly, the exploit spawns a shell with unrestricted access to the BitLocker-protected volume, effectively bypassing disk encryption protections.
This disclosure follows Chaotic Eclipse's recent release of RoguePlanet, a Microsoft Defender zero-day enabling local privilege escalation to SYSTEM, and represents their second BitLocker bypass after YellowKey (CVE-2026-45585), which Microsoft patched in this week's Patch Tuesday updates. The rapid succession of disclosures from this researcher highlights ongoing challenges in Windows security architecture, particularly around recovery mechanisms and credential management.
Mentioned in this report
Detection guidance
Suspicious Creation or Modification of Recovery Environment Configuration Files (unattend.xml / ReAgent.xml)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation or modification of unattend.xml or ReAgent.xml on recovery partitions, consistent with WinRE-based BitLocker bypass staging. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Recovery Partition XML Configuration File Write
id: 3deea723-5743-5a63-a202-02016cdb1dd0
status: experimental
description: 'Detects file creation or modification events for unattend.xml or ReAgent.xml
located under a Recovery\WindowsRE directory or at the root of a volume, which is
the staging technique used by the GreatXML BitLocker bypass to plant malicious answer
files that are processed when booting into Windows Recovery Environment.
'
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith:
- \Recovery\WindowsRE\ReAgent.xml
- \unattend.xml
filter:
Image|endswith:
- \TrustedInstaller.exe
- \reagentc.exe
- \dism.exe
- \sysprep.exe
condition: selection and not filter
falsepositives:
- Legitimate OEM imaging, Sysprep, or deployment tooling that writes unattend.xml
or ReAgent.xml as part of authorized provisioning
- Administrator-driven WinRE customization performed via DISM or reagentc.exe
level: high
tags:
- attack.t1490
author: Vorant
ReagentC Command Forcing Boot Into Windows Recovery Environment
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects use of reagentc.exe to enable or force the next boot into WinRE, a step attackers can abuse to trigger processing of malicious recovery XML files for BitLocker bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ReagentC Used to Force Boot Into WinRE
id: 4317dae8-9512-5fbd-811b-436ea9928670
status: experimental
description: 'Detects execution of reagentc.exe with flags that enable the recovery
environment or force the machine to boot into WinRE on next restart (/boottore,
/enable). This is a legitimate administrative tool but is abused as part of the
GreatXML BitLocker bypass to trigger processing of maliciously placed unattend.xml/ReAgent.xml
files.
'
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \reagentc.exe
CommandLine|contains:
- /boottore
- /enable
filter:
ParentImage|endswith:
- \TiWorker.exe
- \TrustedInstaller.exe
condition: selection and not filter
falsepositives:
- IT administrators intentionally forcing a boot into WinRE for legitimate recovery
or troubleshooting
- Automated deployment scripts that re-enable Windows Recovery Environment after imaging
level: medium
tags:
- attack.t1490
- attack.t1068
author: Vorant
Shell Process Spawned From Windows Recovery Environment RAM Disk
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects process creation events originating from the WinRE X:\ RAM disk environment, indicating an interactive shell obtained during recovery boot that may be used to directly access BitLocker-protected volumes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Execution From WinRE RAM Disk Drive
id: 9fb3182c-20cb-51d9-9549-6d1a6cf828ae
status: experimental
description: 'Detects process creation where the executed image or its parent resides
on the X:\ drive, which is the RAM disk letter assigned during Windows Recovery
Environment (WinRE) sessions. Legitimate recovery tools run here, but an unexpected
interactive shell (cmd.exe, powershell.exe) launched from X:\ is consistent with
the GreatXML technique of obtaining unrestricted shell access to bypass BitLocker
via WinRE.
'
logsource:
category: process_creation
product: windows
detection:
selection:
Image|startswith: X:\
Image|endswith:
- \cmd.exe
- \powershell.exe
- \cscript.exe
- \wscript.exe
condition: selection
falsepositives:
- Legitimate use of the command prompt or PowerShell from WinRE by support staff during
authorized recovery operations
- OEM or IT recovery tools that intentionally launch scripting engines from the WinRE
RAM disk
level: medium
tags:
- attack.t1006
- attack.stealth
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thehackernews.com/2026/06/new-greatxml-exploit-bypasses-windows.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs