Executive Summary
A security researcher known as Chaotic Eclipse (MSNightmare) has publicly disclosed several zero-day privilege escalation exploits targeting prominent Endpoint Detection and Response (EDR) platforms. The most recent discovery, dubbed FalconFlank, abuses malicious macro remediation logic within the CrowdStrike Falcon Sensor to escalate privileges on Windows 11 and Windows Server 2025 systems.
Additional exploits released by the same researcher include 'HardBreacher,' which impacts Kaspersky Endpoint Security (v14.0.0.504), and 'ShieldBreak' (CVE-2026-69414), a patch bypass for a Microsoft Defender vulnerability. These exploits typically utilize techniques such as DLL hijacking and file system redirection to manipulate security software's remediation processes into performing unauthorized actions, such as writing malicious files to protected system directories.
The public release of these PoCs increases the risk of local privilege escalation (LPE) attacks across diverse enterprise environments. Organizations using the affected EDR products should monitor for the specific file artifacts and process behaviors described in the researcher's public repositories, as official patches for some of these flaws are currently unavailable.