FalconFlank PoC turns CrowdStrike's macro cleanup into a local privilege escalation
Chaotic Eclipse published working code that abuses Falcon's Office macro removal on fully patched Windows 11 25H2 and Server 2025. It is the fourth endpoint product the researcher has dropped exploit code for, and no CrowdStrike response is on record.
Perspective Coverage
5 publishers- Builder
- Builder 36%
- Operator
- Operator 51%
- Investor
- Investor 13%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+10
- Incentives55
- Confidence68