GreatXML BitLocker Bypass: Public PoC Exploit Disclosed

A researcher published a public proof-of-concept for the “GreatXML” exploit that manipulates Windows Defender Offline Scan / WinRE to bypass BitLocker and spawn an unrestricted administrative shell; the attack requires placing an unattend.xml and a Recovery directory on the recovery partition and booting into WinRE (or a system in the offline-scan state), so it poses a serious local/physical risk to affected systems—proof-of-concept code is available on GitHub and Microsoft is expected to issue a patch.