Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon
Researcher Chaotic Eclipse released FalconFlank, a zero-day privilege escalation PoC abusing CrowdStrike Falcon's Office macro remediation; CrowdStrike is investigating and issued a tech alert.
Researcher Chaotic Eclipse published FalconFlank, a proof-of-concept zero-day local privilege escalation in CrowdStrike Falcon Sensor that abuses the Microsoft Office malicious macros remediation feature, tested on fully updated Windows 11 25H2 and Windows Server 2025. CrowdStrike said it is investigating, advised disabling the Microsoft Office File Suspicious Macro Removal policy, and pointed customers to a FalconFlank tech alert, noting cloud anti-malware protection remains active. The article also covers related PoCs from the same researcher: HardBreacher against Kaspersky (fixed via update), ShieldBreak (CVE-2026-69414) against Microsoft Defender, an unpatched patch bypass of CVE-2026-50656, GreenSection against NVIDIA, and PrettyPrague against Avast, which Gen Digital patched in versions 26.7.11086 and 26.8.11125.
- FalconFlank abuses CrowdStrike Falcon's Office malicious macro remediation for privilege escalation
- CrowdStrike advises disabling Microsoft Office File Suspicious Macro Removal policy; cloud anti-malware still protects
- Same researcher released HardBreacher (Kaspersky, fixed) and ShieldBreak CVE-2026-69414 (Microsoft Defender, unpatched)
- Gen Digital patched the Avast PrettyPrague privilege escalation; NVIDIA GreenSection PoC also published
- Organizations
- Chaotic Eclipse
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-50656 | Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet " | 7.0 | 11% | PoC | |
| CVE-2026-69414 | Local Elevation of Privilege in Microsoft Defender Malware Protection Engine | 7.8 | 1% | PoC |
From the original article
4 min read at thehackernews.com
The security researcher known as Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has dropped a new zero-day dubbed FalconFlank, a proof-of-concept (PoC) for a privilege escalation flaw impacting Crowdstrike Falcon. "FalconFlank is a 0-day privilege escalation that abuses the office malicious macros remediation in CrowdStrike Falcon Sensor," the researcher said in
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.