Researcher Publishes CrowdStrike Privilege Escalation Zero Day
Researcher NightmareEclipse published FalconFlank, a zero-day local privilege escalation in CrowdStrike Falcon Sensor abusing its Office malicious macro remediation feature.
A researcher known as Nightmare Eclipse published details of FalconFlank, a zero-day privilege escalation that abuses the Microsoft Office malicious macro removal feature in CrowdStrike Falcon Sensor, verified working on fully updated Windows 11 25H2 and Windows Server 2025 with Falcon Phase 3 Optimal Protection. CrowdStrike urged customers to disable the Office File Suspicious Macro Removal policy while it investigates, noting customers remain protected via Cloud Anti-malware for Microsoft Office Files; no CVE has been assigned. The same researcher previously released the Exploitarium dump of over 30 PoC exploits, and researcher Kevin Beaumont confirmed FalconFlank works.
- FalconFlank abuses Falcon Sensor's Microsoft Office malicious macro removal for local privilege escalation
- Works on fully patched Windows 11 25H2 and Windows Server 2025 with Falcon Phase 3 Optimal Protection
- CrowdStrike advises disabling the Suspicious Macro Removal policy; no CVE assigned yet
- Same researcher previously published 30+ PoCs affecting Linux kernel, Libssh2, FFmpeg, Gogs, Gitea
- Organizations
- CybaVerse
From the original article
2 min read at infosecurity-magazine.com
A security researcher has posted a zero-day exploit in CrowdStrike which could allow hackers to escalate privileges
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.