A Critical Zero-Day Exploit in CrowdStrike Falcon Enables System Privileges Escalation
A severe zero-day vulnerability has been discovered in CrowdStrike’s popular endpoint security platform, Falcon. Dubbed “FalconFlank” by the anonymous security researcher who uncovered it, this exploit allows attackers to gain SYSTEM privileges on up-to-date Windows systems, including those running Windows 11 and Windows Server.
The vulnerability affects devices equipped with the latest versions of Windows 11 (25H2) and Windows Server 2025, as well as CrowdStrike’s endpoint security platform. By exploiting a weakness in the Office malicious macros remediation feature within Falcon Sensor, attackers can spawn a command prompt with SYSTEM privileges. This is particularly concerning, given that successful exploitation allows for full access to the affected system.
According to Nightmare Eclipse, the researcher behind the discovery, the exploit works on fully updated Windows 11 and Windows Server systems with CrowdStrike Falcon installed. The researcher has stated that CrowdStrike would likely have already implemented detections for this vulnerability by the time it was publicly disclosed. To test the exploit, one would need to either add it to exclusions or obfuscate the proof-of-concept (PoC) code and modify the DLL load technique.
CrowdStrike is currently investigating the claims and has advised customers to disable the Microsoft Office Windows policy setting that toggles the security software’s File Suspicious Macro Removal feature. However, this advisory is not publicly available and can only be accessed by customers with an account on CrowdStrike’s support portal. The company has yet to provide further details regarding a CVE ID assignment for the FalconFlank flaw.
This vulnerability is part of a larger trend of zero-day exploits being released by Nightmare Eclipse in recent weeks. The researcher has also disclosed privilege escalation zero-day exploits for Kaspersky Antivirus for Endpoint (HardBreacher) and GenDigital Avast Antivirus (PrettyPrague), as well as a denial-of-service zero-day for Nvidia (GreenSection).
This situation highlights the importance of keeping security software up-to-date, including CrowdStrike’s Falcon platform. Furthermore, it underscores the need for robust incident response plans in place to mitigate the impact of such vulnerabilities.
Given the severity of this exploit and its potential consequences, we urge all users of CrowdStrike’s Falcon platform to review their security settings and follow the company’s guidance on disabling the affected policy setting. Additionally, we recommend that organizations remain vigilant and take proactive measures to protect themselves against similar attacks in the future.
To stay ahead of such threats, it is essential for security teams to regularly review their defenses and ensure they are equipped with the latest tools and techniques to detect and respond to emerging vulnerabilities. By doing so, they can minimize the risk of falling victim to zero-day exploits like FalconFlank.
Source: Bleeping Computer — 2026-09-04