Researcher publicly releases exploit for CrowdStrike Falcon privilege escalation
Security researcher Nightmare Eclipse, previously known for a string of Microsoft zero-days, has published a proof-of-concept exploit for a new privilege escalation flaw in CrowdStrike's Falcon endpoint security platform, dubbed FalconFlank. The bug abuses Falcon's automated feature for stripping malicious macros from Microsoft Office documents, and works against fully updated Windows 11 25H2 and Windows Server 2025 machines running Falcon's Phase 3 optimal protection with the macro-removal feature enabled. It matters because it signals the researcher expanding their focus beyond Microsoft to the wider endpoint-security industry, raising questions about the robustness of tools that are themselves meant to defend against attacks.
CrowdStrike said it is investigating the claims and has advised customers to disable the "Microsoft Office File Suspicious Macro Removal" Windows policy setting while noting that its Cloud Anti-malware protections remain in place; researcher Kevin Beaumont confirmed the exploit works. FalconFlank follows a run of other disclosures from Nightmare Eclipse in recent days, including HardBreacher, a privilege escalation bug in Kaspersky's commercial endpoint antivirus, and PrettyPrague, an Avast flaw that can dump the Windows SAM database and spawn a SYSTEM shell. Gen Digital, which owns Avast, confirmed it is developing a patch; Kaspersky did not respond to requests for comment, and the researcher also released an Nvidia zero-day, GreenSection, which reportedly only crashes systems rather than escalating privileges.
In short
- Researcher publishes CrowdStrike Falcon privilege escalation exploit, FalconFlank.
- CrowdStrike advises disabling a macro-removal policy setting as a workaround.
- Researcher also hit Kaspersky, Avast and Nvidia products this week.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Publicly releasing a proof of concept can help defenders and affected customers understand the flaw, assess their exposure and press for a timely fix. The researcher may also argue that visible, reproducible evidence makes the risk harder to dismiss and draws attention to weaknesses in security products entrusted with protecting systems.
The case against
A working exploit can give attackers a practical route to privilege escalation on affected machines before a patch is available, increasing risk for customers who have not disabled the setting. Critics may argue that coordinated disclosure, allowing time for a fix and customer protections first, would better serve users while still enabling scrutiny.
Explained simply
CrowdStrike Falcon is security software that organisations use to monitor Windows computers and block malicious activity. It can automatically remove suspicious macros, small bits of code that can make Office documents carry out harmful actions. A privilege escalation flaw lets someone with limited access gain greater control of a computer.
The disclosure concerns a researcher known as Nightmare Eclipse and a claimed flaw in Falcon’s macro-removal feature. CrowdStrike makes Falcon, while customers configure and run it on their own devices; independent researchers investigate and publish security flaws. The issue matters because organisations rely on endpoint security tools to protect computers, so weaknesses in those tools can affect the protection they provide.
Read the full article at the source →
Originally published by The Register as “Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC”.