GreatXML: Exploiting the WinRE trust boundary behind BitLocker

Nightmare Eclipse (aka Chaotic Eclipse) published a zero-day named GreatXML (June 10, 2026) that allows an attacker with local administrator access to bypass BitLocker by abusing the Windows Recovery Environment, Microsoft Defender Offline scan, and Windows Setup unattend files to execute commands as SYSTEM; the report includes technical analysis, replication steps, IOCs for detection, and corresponding ThreatLocker community policies.