FalconFlank Zero-Day Targets CrowdStrike Falcon Macro Remediation

A security researcher known as Chaotic Eclipse (alias Nightmare Eclipse or MSNightmare) has publicly released a proof-of-concept (PoC) exploit named FalconFlank targeting a zero-day vulnerability in the CrowdStrike Falcon Sensor. The vulnerability allows for local privilege escalation (LPE) to SYSTEM by abusing the sensor's remediation workflow for malicious Microsoft Office macros. The exploit is reported to be effective on fully patched Windows 11 (25H2) and Windows Server 2025 systems where the macro removal feature is enabled.

This release follows a broader campaign by the researcher targeting several endpoint security products, including Microsoft Defender (ShieldBreak/CVE-2026-69414), Kaspersky (HardBreacher), and Avast (PrettyPrague). The researcher has explicitly stated a refusal to engage in coordinated disclosure, opting instead to release functional exploit code to public repositories. CrowdStrike is currently investigating the claims and has issued a temporary mitigation guidance for affected customers.

While the public PoC may be detected by current EDR signatures, the underlying architectural flaw remains unpatched. Organizations using CrowdStrike Falcon on modern Windows environments face a high risk of local privilege escalation if an attacker gains initial low-privileged access. The researcher's history suggests that their PoCs are often weaponized in the wild shortly after release, as seen with previous exploits like BlueHammer and RedSun.