I don't think there is a way to get a CMenu from the current state of the menu bar.

There is a member of CXTPMenuBar m_hMenuDefault that is a menu handle of the default menu loaded into the menu bar but it is set via:

m_hMenuDefault = ::GetMenu(GetSite()->GetSafeHwnd());

So you can just get that yourself without the menu bar.

I don't think this is of help in your case. You can build up a menu from the Controls of the menu bar by reversing the proces of the LoadMenu function in XTPCommandBar.cpp. The function is very simple and straight forward, and would not be a very big job to write its reverse.

Unless you need to pass the CMenu* to a function out of your control it would probably be easier to rewrite your code to deal directly with the XTP classes and functions. Of course unless you don't want to be permanently married to the XTP implementation. 

I did rewrite my code in terms of the XTP classes and it simplified my code enourmously.