Reported by 4 outlets

Timeline

1. original reporting

   CrowdStrike 'FalconFlank' zero-day grants SYSTEM privileges

   bleepingcomputer.com · 39d ago · September 4th, 2026

   An anonymous security researcher who uses the " Nightmare Eclipse " handle released a CrowdStrike Falcon zero-day exploit named " FalconFlank " that lets attackers escalate privileges on up-to-date Windows systems. Nightmare Eclipse says the new vulnerability (which has yet to be assigned a CVE ID) affects devices running the latest versions of Windows 11 and Windows Server, as well as CrowdStrike's endpoint security platform. Successful exploitation allows attackers to spawn a command prompt with SYSTEM privileges by abusing CrowdStrike Falcon's Office malicious macros remediation feature. "FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon Sensor, obviously by the time I drop this Crowdstrike would already have detections for it so if you want to test you either have to add it to the exclusions or obfuscate the PoC and change the dll load technique," Nightmare Eclipse said . "As of now it works in a fully updated windows 11 25H2 / Windows Server 2025 with Crowdstrike Falcon." When BleepingComputer asked for more details about this vulnerability, a CrowdStrike spokesperson said the company is investigating the researcher's claims and advised customers to disable the Microsoft Office Windows policy setting that toggles the security software's File Suspicious Macro Removal feature. "We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windo

2. update from gbhackers.com

   CrowdStrike Falcon Zero-Day Lets Attackers Escalate Privileges on Windows Systems

   gbhackers.com · 39d ago · September 4th, 2026

   CrowdStrike Falcon Zero-Day The project was published on […] The post CrowdStrike Falcon Zero-Day Lets Attackers Escalate Privileges on Windows Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from cyberpress.org

   FalconFlank PoC Claims CrowdStrike Falcon Zero-Day Enables Privilege Escalation on Windows

   cyberpress.org · 39d ago · September 4th, 2026

   A proof-of-concept (PoC) dubbed FalconFlank claims to exploit a previously undisclosed privilege-escalation issue in the CrowdStrike Falcon Sensor for Windows . The alleged flaw is said to abuse Falcon’s remediation workflow for malicious Microsoft Office macros, potentially allowing a lower-privileged user to gain elevated access on fully patched Windows endpoints. The claim has not been independently verified, and there is no indication at the time of writing that CrowdStrike has publicly confirmed the vulnerability’s existence, assigned a CVE identifier, or released a security advisory. Organizations should therefore treat the FalconFlank report as an unverified security claim until the vendor or independent researchers provide further technical validation. The reported issue centers on how the Falcon Sensor responds when it identifies and remediates a malicious Office macro. Endpoint detection and response products frequently perform remediation tasks with elevated system privileges because they must inspect, quarantine, modify, or remove suspicious files that may be inaccessible to standard users. Fal

4. update from malware.news

   Privilege Escalation Vulnerability in Falcon Crowdstrike

   malware.news · 39d ago · September 4th, 2026

   This setting can be found in the Next-gen antivirus settings under Clean infected Microsoft Office files. After turning off the above feature, malicious macros will no longer be replaced. Customers with prevention policy settings configured, as per best practices, will remain protected. Prevention will continue to operate as normal via the Cloud Anti-malware for Microsoft Office Files settings. References [1] https://github.com/MSNightmare/FalconFlank The post Privilege Escalation Vulnerability in Falcon Crowdstrike appeared first on Truesec .