Security researcher Will Dormann says the writeup is flawed — the trigger condition requires admin access that already permits turning BitLocker off, even as Microsoft has yet to respond on GreatXML or any patch timeline.
Microsoft's Defender Offline scan appears to leave a forensic artifact on Windows boxes that, by Nightmare Eclipse's account, can be turned into a BitLocker skeleton key. The catch is in the only independent reproduction so far: security researcher Will Dormann says the writeup is flawed, and that the precondition already requires the kind of access that defeats BitLocker on its own.
GreatXML, the eighth zero-day attributed to the researcher known as Nightmare Eclipse, was published on 2026-06-10 on GitHub and a self-hosted Git server, with a PGP-signed blog post following a day later. The claim, as reported by The Register, is that any Windows machine that has ever been put through a Microsoft Defender Offline scan can be coerced into spawning a command prompt with full access to the BitLocker-encrypted volume. The mechanism, per the researcher's own writeup, is to copy an "unattend.xml" file and the "Recovery" directory to the root of the recovery partition, then Shift+Restart into the Windows Recovery Environment.
Dormann attempted to reproduce the technique across three Windows 11 lineages and posted a counter-claim on Mastodon. His finding: the command prompt in the researcher's screenshots appears only on the next Defender Offline scan run, and triggering that scan requires a session logged in as an administrator. An admin who is already authenticated on a Windows host can turn BitLocker off through standard management tools, which makes the GreatXML trigger condition, in Dormann's reading, not a true bypass of BitLocker at all.
That distinction matters because the wire copy framed GreatXML as a "total access" bypass of Microsoft's flagship disk encryption. The Register also reported that the exploit is being publicized after the researcher had not filed it through official Microsoft channels, which puts it in the same disclosure posture as the seven Nightmare Eclipse zero-days that preceded it.
Six of those prior disclosures received fixes in the 2026-06-09 Microsoft Patch Tuesday, including RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma. RoguePlanet, a Windows Defender local privilege escalation to SYSTEM, dropped on 2026-06-09, the day before GreatXML. Microsoft told The Register it is "actively investigating the validity and potential applicability" of the RoguePlanet claims, and had not responded to inquiries about GreatXML or any patch timeline by the article's deadline.
Microsoft's posture toward Nightmare Eclipse itself has been a separate story. The company has said none of the researcher's disclosures came through official channels before public release. Microsoft previously banned the researcher's GitHub account, then reportedly threatened legal action, and then walked that threat back after the security community pushed back. Microsoft's official Defender Offline documentation describes the tool as a malware-removal scan that runs from a recovery environment when the regular antimalware engine cannot clean a threat.
The structural point survives Dormann's critique. The researcher's claim, even where it does not reproduce cleanly, describes a path that runs through a Microsoft recovery environment and reuses an artifact left by a Microsoft defensive tool. If the writeup is wrong about the precondition, the architecture it points at is still real: a defender product that runs in the same boot path as the encryption product it is supposed to protect has to be designed under the assumption that anything it leaves behind on disk will be available to anything else that boots there. Defender Offline is, in the product's own framing, a recovery environment. The same recovery environment is the entry point the researcher is trying to reach.
A second strand of context comes from a post by Brian Krebs on Mastodon, citing researchers who say Nightmare Eclipse may be a former Microsoft employee with a "very personal grudge" against Microsoft's bug-bounty communications. The post is attributed hearsay: Krebs does not name a primary source, and Microsoft has not confirmed the identity claim. The researcher's own 2026-06-03 blog post cited burnout from the RoguePlanet work and said they would likely miss a previously pledged 2026-07-14 mass-disclosure window, a pledge the next day's GreatXML release effectively superseded.
What to watch next: whether Microsoft issues a CVE and patch for the GreatXML claim on its own schedule or waits for broader community reproduction, whether more independent testers publish results in the same vein as Dormann, and whether the researcher's disclosure posture changes after the community reaction to the legal-threat walk-back. The story's durable shape is not who is right between researcher and vendor, but whether a vendor's defensive tool and a vendor's encryption product are designed against each other as adversaries or as collaborators. As of this writing, the public evidence points to the first.