Chaotic Eclipse Releases Crowdstrike Falcon ZeroDay FalconFlank
Researcher Chaotic Eclipse released FalconFlank, a PoC zero-day privilege escalation exploit against CrowdStrike Falcon's Microsoft Office macro removal feature.
Security researcher Chaotic Eclipse (also known as Nightmare Eclipse) published FalconFlank, a proof-of-concept zero-day exploit for a privilege escalation flaw in CrowdStrike Falcon Sensor. It abuses the Microsoft Office file malicious macro removal remediation feature, which runs with high privileges, and works on fully updated Windows 11 25H2 and Windows Server 2025 with Falcon Phase 3 Optimal Protection. CrowdStrike says it is investigating and advises customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy. The same researcher recently released zero-day PoCs against Kaspersky Endpoint Security (HardBreacher) and Avast Antivirus (PrettyPrague), the latter dumping the SAM database for a SYSTEM shell.
- FalconFlank abuses Falcon's Microsoft Office file malicious macro removal feature, which operates with high privileges
- PoC requires Falcon Phase 3 Optimal Protection with the malicious macro removal feature enabled on patched Windows 11 25H2 or Server 2025
- CrowdStrike advises disabling the Microsoft Office File Suspicious Macro Removal policy while customers stay protected by Cloud Anti-malware for Microsoft Office Files
- Researcher also published Kaspersky HardBreacher and Avast PrettyPrague zero-day privilege escalation PoCs, with Avast flaw possibly extending to AVG and Norton
- Highlights broader issue that EDR elevated privileges can become a local privilege escalation attack surface
From the original article
3 min read at securityaffairs.com
Chaotic Eclipse released FalconFlank, a PoC exploit for a Crowdstrike Falcon ZeroDay Elevation of Privileges Vulnerability Security researcher Chaotic Eclipse , also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a new zero-day exploit targeting Crowdstrike Falcon cybersecurity platform. The researcher named the exploit FalconFlank, it triggers a privilege escalation flaw.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.