# New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files

> **Open Intelligence Dossier** · First detected: 2026-06-11 22:07 UTC · Category: Technology

## Executive Summary
Security researchers have identified a new zero-day exploit named GreatXML that bypasses Windows BitLocker encryption via recovery partition XML files.

## Intelligence Brief
A new zero-day vulnerability dubbed GreatXML allows unauthorized access to Windows BitLocker encryption. The exploit reportedly utilizes specific XML files located within the recovery partition to bypass existing security measures. Coverage from TechRepublic, SecurityWeek, and HotHardware highlights the discovery alongside another zero-day identified as RoguePlanet.


Reports from BleepingComputer and Dark Reading note that RoguePlanet grants SYSTEM privileges through Microsoft Defender. Thestack.technology emphasizes that these disclosures coincide with the June Patch Tuesday release cycle. Observers are tracking the response from Microsoft regarding the disclosure fight and the efficacy of subsequent patches.


MakeUseOf notes that the practical impact of the BitLocker exploit may vary for individual users, though official documentation on mitigation steps remains the primary focus.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| TechRepublic | New Windows Zero-Day Claims BitLocker Bypass Amid Microsoft Disclosure Fight | [Source Link](https://news.google.com/rss/articles/CBMihgFBVV95cUxNUFkxZkpLaDYtMmJpQk82dnpXNkl2WTBvaWI0MzRvZkFnTVJBOHdlNHc4bjhCSTU1SGQwNjFISXlNWlA5bmVzT2VNT1FWSG5MS1RDRHh4a0VqY0R4MHNvN2ZzVHhoUFpCRVNlQXVQbTBZSnVQR2d2aUtOWUp1by1yb29BWnRRdw?oc=5) |
| BleepingComputer | Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges | [Source Link](https://news.google.com/rss/articles/CBMiswFBVV95cUxOQzFyOVN5bTE2OEl5YmRzdFhieDNETFhpZDN1dVlPck9Ya29BaXQybUxwN2xnWndjNWRiUUNaWE5qSm5VYzhLX2h4OGlnOTRlb1lZenAtMWJKUkM4REFVTFBWRS1TSGUxcGNyTDc4ZFZqeVQyRjdhY3dBS19fcDdnMGYyTzViTjlISm1LcTNJdGswRGhOT2RhR2NMWm9GU0NJSTRGTFZON2trSUdONGFjSTBLc9IBuAFBVV95cUxOdVNCRUpMcW4tdXZvYVFRNzcyNG42d3doMzJnYy1KQ3hRYkp4eWVaOFhxeG1aRDE5c1EyTnM1WHRKQnR5UjVnU2hoT1lScUtpZXpSenAxRWMxQWg4STRFb2t6UzF2MGpjQUpEcU4yOXh6V19NSk9ZaEhJak5zQkNVN1NJT3hMN0o0Uk0zZjYwZ25SLWRyNEtESk1EYmJnV2d) |
| thestack.technology | Defender under Attack: June's Patch Tuesday in the spotlight | [Source Link](https://news.google.com/rss/articles/CBMipgFBVV95cUxQZXRIbHBzd2o2RFhXMFVNSk95WHFtU2IxUGl3VW9ST25vYkNtRzFVVGZvSnpORmZXTEZPYTB3OHFJempzX1FpOS1DaF90a050MXJjZ3lGU25ZaWxKel9aS3BLRUdDUlZTMGk5RkV5em42STg0Rmt0STJKek1USkRJNGVrUkR6U0VpdUNwMlRXX0x6bjRiT25yeXhKV013QVY5WVRqeWd3?oc=5) |
| Dark Reading | Nightmare-Eclipse Drops Yet Another Microsoft Exploit, RoguePlanet | [Source Link](https://news.google.com/rss/articles/CBMioAFBVV95cUxNaWhLakRnWG51T2hIdTFKZVR1bHk2UGIyblRPRERxeEE5Q0V4eFNnUGNUcVM3Y0ticTVYT2hIa0p0YU81N0N0YVVNMVdjbnhQOXN5N2ExcVAwQnFLcVN5dXVDdUFTTUZEM1VST2NmX2p4MU1scHFlNGlremRRMmRXRDU3NGRDQVNXYlBvc2x0VnhZQ2pIeEI5MkF6YlNWQXJm?oc=5) |
| HotHardware | Nightmare-Eclipse Drops Another BitLocker Bypass After YellowKey Patch | [Source Link](https://news.google.com/rss/articles/CBMioAFBVV95cUxNTEhPdlFQNlRiWHQ3RkxWQ2NvOXY4dTIyR1RXeEdvUFRsMnpnNmY5RXNIeTBXS2FjN0NuNkREOEdtNzRnSlNTcDFvMFRpQ3dBWTFFY3FnTWV3d0dyOEZQSm14NklaTlVWRDhOeWtVQUlqLTJ3aGk5T1psMi1acENlZ2RkWGtHSDBEYmc0bEs3VnZ6VHNmaUE5ek42OUcwZVFD?oc=5) |
| MakeUseOf | The new BitLocker exploit everyone's freaking out about probably won't affect you | [Source Link](https://news.google.com/rss/articles/CBMifkFVX3lxTE5udFpwYkRUZ2JmSnlySGVFanNZcXJVeDVvanlRc1ZOamh1VDdySFFuYUhFRWVJazJfV3lxZkxCVUQ0T2ZvNU9ZV1FDODJheGVKZ18tamo3ZXZ1SFppb3NkNHRQMU13TEtUZUwya2tKaUNhWkZiNnNlTFNYckpVQQ?oc=5) |
| SecurityWeek | ‘GreatXML’ Zero-Day Exploit Bypasses BitLocker | [Source Link](https://news.google.com/rss/articles/CBMif0FVX3lxTFBESjNUWnl3WE5NeDRjaFdBN0dER0JpTlZMVk9raUxUOVJLQTczRV9fczQ5SW9KckNXeTg3MUlRR19DX3NFM2dnb0ltOXNsR2dmc3ZtZzV2RTZ2ZWhkYnBJdVhLZmZsNUZKR2ZCX3ZnY3VvSzNhbTdPVWxpTVcxVWvSAYQBQVVfeXFMTjRkRzZVR1pYNkNYR2d3Qmx5QkNINmFRc0J3QmMyLVNIa0xBZlNnTjVER2hxMHpFRnJtUERnYWh4eGdIVGticXZKbnVOUUVWMmwzTGtuUkhkUE1UdjNpelRsVFg3STRjNzVVMkxXWEtBVDZTRm1Uc3loY19pZWdtMEp1TTF4?oc=5) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-06-11/new-greatxml-exploit-bypasses-windows-bitlocker-via-recovery-partition-xml-files*