A New Zero-Day Exploit from CrowdStrike Lets Attackers Gain SYSTEM Privileges
In a shocking revelation, an anonymous security researcher going by the handle “Nightmare Eclipse” has released a zero-day exploit in CrowdStrike’s Falcon endpoint security platform. Dubbed “FalconFlank,” this vulnerability allows attackers to escalate privileges on up-to-date Windows systems, potentially granting them unfettered access to sensitive data and system resources.
The exploit targets devices running the latest versions of Windows 11 and Windows Server, as well as CrowdStrike’s own endpoint security software. By abusing a feature called Office malicious macros remediation, attackers can spawn a command prompt with SYSTEM privileges – essentially giving them godlike powers on the compromised system.
According to Nightmare Eclipse, who released the exploit along with several others targeting various security products this week, FalconFlank works on fully updated Windows 11 and Windows Server systems running CrowdStrike’s Falcon sensor. The researcher warned that Crowdstrike would likely have detections for the exploit by the time it was publicly disclosed, making it difficult to test without disabling certain security settings.
CrowdStrike has acknowledged the vulnerability but has yet to provide further details or assign a CVE ID to the flaw. Instead, the company advised customers to disable the Microsoft Office Windows policy setting that toggles the File Suspicious Macro Removal feature – a workaround that, while effective, may not be ideal for users who rely on this security feature.
This latest exploit is part of a growing trend of zero-day vulnerabilities being disclosed by Nightmare Eclipse, which has also targeted Kaspersky Antivirus for Endpoint and GenDigital Avast Antivirus. The researcher’s exploits often highlight the weaknesses in popular security products, leaving many to wonder how these flaws were missed during testing and quality assurance.
For users relying on CrowdStrike or other endpoint security solutions, this exploit serves as a stark reminder of the importance of staying vigilant and up-to-date with the latest patches and software updates. In addition, disabling certain security features – albeit temporarily – may be necessary to test for vulnerabilities like FalconFlank.
Ultimately, this zero-day exploit underscores the cat-and-mouse game played by attackers and security vendors in the ever-evolving landscape of cybersecurity threats. As users, it’s essential to stay informed about emerging threats and take proactive steps to mitigate risks, rather than relying solely on security software to protect against all potential dangers.
Source: Bleeping Computer — 2026-09-04