FalconFlank PoC turns CrowdStrike's macro cleanup into a local privilege escalation
Chaotic Eclipse published working code that abuses Falcon's Office macro removal on fully patched Windows 11 25H2 and Server 2025. It is the fourth endpoint product the researcher has dropped exploit code for, and no CrowdStrike response is on record.
The Watch · Security desk
What happened
- The proof of concept runs on fully updated Windows 11 25H2 and Windows Server 2025 with Falcon set to Phase 3 Optimal Protection and the macro removal feature enabled.
- The Hacker News said it had asked CrowdStrike for comment and would update the story if the company replied.
- Days earlier the same researcher published HardBreacher against Kaspersky Endpoint Security for Windows 14.0.0.504, another local privilege escalation.
Why it matters
- Who's exposed exposure Policy state is the real gate here, not patch level: estates on current Windows builds sit in scope simply because macro removal is enabled under Phase 3.
- What it limits constraint Any in-house test of the public code requires weakening the sensor first, which puts confirmation out of reach for most production fleets.
- Who has to decide decision Watching the agent becomes the SOC's job rather than the vendor's, because the product generating the alerts is the product being abused.
- What it sets up precedent With cleanup engines in two separate products now carrying public exploit code, remediation logic looks like a standing target, not one researcher's lucky find.
Next story · Build · 1h ago
Microsoft ports Defender to the Linux desktop for Plan 2 and E5 or E7 customersConfirmed2 publishers
The privilege in this class of bug comes from the cleanup step. Falcon's Microsoft Office malicious macro removal sits inside the sensor's remediation set and operates with high privileges, and the researcher's claim, per Security Affairs, is that a low-privileged local user can ride that behaviour into a stronger context [9].
What is published is thin. The README names the feature, the platform, and the policy state: Phase 3 Optimal Protection with macro removal switched on [2][3]. For the anatomy of the class, the documented case is the same researcher's Defender bug. LevelBlue described ShieldBreak as Cloud Files, Object Manager namespace manipulation, direct Defender API calls and a timing race in the remediation path, ending with Defender's own clean engine writing an attacker DLL to System32 and SYSTEM execution through the built-in Windows Error Reporting task [13]. Earlier chains from the same researcher, RedSun and LegacyHive, reached the same destination by other routes [14].
The tally now stands at four endpoint products with public exploit code from one person: CrowdStrike, Kaspersky, Microsoft, and Gen Digital's Avast [17]. Two of the four chains go through vendor cleanup code [19]. On vendor position the tally is one fix on record. Kaspersky says HardBreacher is resolved [11]. Microsoft has shipped nothing for ShieldBreak, which is assessed as a bypass of the CVE-2026-50656 patch [12]. CrowdStrike had not responded to The Hacker News, and the reporting carries no Gen Digital response [5][20].
The researcher expects Falcon to flag the published code, and tells anyone testing to add an exclusion or obfuscate the PoC and change the DLL load technique [4]. That is the bind: validating the sensor with the public code requires degrading the sensor first. Security Affairs adds the accompanying caution, that a detection on this PoC leaves open whether the underlying path is closed [10]. Kaspersky's own remedy arrived by automatic update or a manually triggered database update, the channel detection content ships on; the source does not say what changed inside the product [11].
Absent a CrowdStrike statement, the telemetry is yours to assemble, and it is telemetry most shops do not collect about their own agent. That means watching for DLL creation in System32 attributed to sensor-privileged processes, for changes to the macro removal setting in policy, and for execution of the Windows Error Reporting task that the Defender chain used for its final step [13].
Timing is stated rather than guessed. In a post dated 14 August 2026 the researcher said Microsoft refuses to communicate and floated publishing third-party bugs in the window before Patch Tuesday [15]. Security Affairs notes that some earlier releases were later exploited in the wild [16]. Plan around the gap between a drop and a content update, because there is no tracking number to wait for: only the Defender bugs in this set carry CVEs [18].
What to watch
- A CrowdStrike statement or sensor content note that names the macro removal path, which would show whether the answer is detection content or a code change.
- Whether Microsoft ships a fix for ShieldBreak, already assessed as a bypass of the CVE-2026-50656 patch.
- Whether PrettyPrague reaches AVG and Norton as the researcher suspects, taking the Gen Digital footprint from one product to three.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+10
- Incentives55
- Confidence68
Perspective Coverage
5 publishers- Builder
- Builder 36%
- Operator
- Operator 51%
- Investor
- Investor 13%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a zero-day privilege escalation exploit named FalconFlank targeting CrowdStrike Falcon.
- [2]
The researcher's GitHub README states: "FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in CrowdStrike Falcon Sensor."
- [3]
The PoC works on fully updated Windows 11 25H2 and Windows Server 2025 systems running CrowdStrike Falcon with Phase 3 Optimal Protection and the Microsoft Office file malicious macro removal feature enabled.
- [4]
The researcher said CrowdStrike would likely already have detections for the PoC by release, so testers must either add it to exclusions or obfuscate the PoC and change the DLL load technique.
- [5]
The Hacker News said it had contacted CrowdStrike for comment and would update the story if it heard back.
- [6]
Days before FalconFlank, the same researcher released HardBreacher, a PoC for a privilege escalation flaw in Kaspersky's endpoint security product for Windows, version 14.0.0.504.
- [7]
The researcher said the HardBreacher PoC is unstable and must be rerun after failures; on success it creates C:\Windows\System32\MY_SNAKE_IS_SOLID.dll with full permissions for the current user.
- [8]
The researcher also released PrettyPrague, a privilege escalation exploit for Gen Digital's Avast Antivirus that abuses a flaw in the Avast Sandbox to dump the Windows SAM database and gain a SYSTEM shell on fully patched Avast and Windows 11 25H2; the researcher suspects AVG and Norton may also be affected.
- [9]
FalconFlank abuses Falcon's "Microsoft Office file malicious macro removal" feature, which is part of Falcon's remediation capabilities and operates with high privileges; the researcher claims the behaviour can be abused to escalate from a low-privileged local user to a more powerful context.
- [10]
Security Affairs notes that the underlying vulnerability could still exist even if Falcon detects and blocks the specific exploit technique used in the published PoC.
- [11]
Kaspersky told The Hacker News it has resolved the HardBreacher issue and that the corresponding fix is delivered via an automatic update, or users can trigger a database update manually.
- [12]
The researcher published ShieldBreak (CVE-2026-69414), a Microsoft Defender zero-day allowing arbitrary code execution as NT AUTHORITY\SYSTEM, assessed as a patch bypass for CVE-2026-50656 (RoguePlanet); Microsoft has yet to release a fix.
- [13]
LevelBlue said ShieldBreak combines Cloud Files, Object Manager namespace manipulation, direct Windows Defender API invocation and a timing race in the remediation path, redirecting Defender's own clean engine to write an attacker-supplied DLL to C:\Windows\System32\phoneinfo.dll, followed by SYSTEM execution through the built-in Windows Error Reporting task.
- [14]
LevelBlue said RedSun abused the Cloud Files API and TieringEngineService to redirect a Defender write into System32, while LegacyHive weaponised offline registry hive manipulation and the NT Object Manager namespace.
- [15]
In a post dated 14 August 2026 the researcher said Microsoft refuses any sort of communication and wrote: "Think I will start publishing bugs for third-parties in that window where Patch Tuesday isn't released yet."
- [16]
Security Affairs says the researcher's releases have mainly targeted Microsoft products, with some later exploited in the wild, among them the Undefend and RedSun Defender zero-days.
- [17]
Across this run of releases, four distinct endpoint security vendors have public exploit code from this researcher: CrowdStrike, Kaspersky, Microsoft and Gen Digital (Avast).
- [18]
Only the Microsoft Defender bugs in this set carry CVE identifiers (CVE-2026-69414 and CVE-2026-50656); FalconFlank, HardBreacher and PrettyPrague appear under codenames alone.
- [19]
Two of the four chains route through the vendor's own cleanup or remediation code: Falcon's Office macro removal and Defender's remediation path in ShieldBreak.
- [20]
Of those four vendors, the reporting records a shipped fix for one (Kaspersky); Microsoft has none for ShieldBreak, CrowdStrike had not responded, and no Gen Digital response appears in the material.
Sources
5 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comNew CrowdStrike 'FalconFlank' zero-day grants SYSTEM privileges
2 articles · September 4, 2026
- infosecurity-magazine.comResearcher Publishes CrowdStrike Privilege Escalation Zero Day
1 article · September 7, 2026
- securityaffairs.comChaotic Eclipse Releases Crowdstrike Falcon ZeroDay FalconFlank
1 article · September 3, 2026
- securityweek.comNightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits
1 article · September 7, 2026
- thehackernews.comResearcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon
2 articles · September 3, 2026