CrowdStrike FalconFlank: Zero-Day Privilege Escalation Weaponizes EDR's Own Macro Remediation

On September 3, 2026, researcher Chaotic Eclipse publicly released FalconFlank, a proof-of-concept for a zero-day vulnerability that turns a CrowdStrike Falcon Sensor protection feature into an attack vector. The exploit abuses Microsoft Office's malicious macro removal function to execute code with SYSTEM privileges, making the EDR product itself the weak point in the infrastructure.

On September 3, 2026, researcher Chaotic Eclipse publicly released FalconFlank, a proof-of-concept for a zero-day vulnerability that turns a CrowdStrike Falcon Sensor protection feature into an attack vector. The exploit abuses Microsoft Office's malicious macro removal function to execute code with SYSTEM privileges, making the EDR product itself the weak point in the infrastructure.

Key Takeaways

Chaotic Eclipse published the FalconFlank PoC on GitHub on September 3, 2026; the technique exploits Office macro remediation in the Falcon Sensor.
The exploit works on Windows 11 25H2 and Windows Server 2025 with Phase 3 Optimal Protection configuration and the "Microsoft Office file malicious macro removal" feature enabled.
Kevin Beaumont independently confirmed the exploit "works," without providing additional technical details.
CrowdStrike stated it is investigating and indicated disabling the specific policy as a temporary mitigation, referring to the Tech Alert in the customer support portal.

How the EDR Becomes the Vector: The FalconFlank Mechanism

The core of the vulnerability lies in the protection architecture itself. The Falcon Sensor includes a remediation function for malicious macros in Microsoft Office files: when it detects a suspicious document, the removal process operates with elevated privileges to neutralize the threat. Chaotic Eclipse demonstrated that this process can be manipulated to load and execute an arbitrary DLL in the same privileged context.

The privilege escalation is therefore realized not through an operating system flaw, but through the security product installed to protect it. The researcher specified that the PoC is tested on Windows 11 25H2 and Windows Server 2025 with the Phase 3 Optimal Protection configuration, and explicitly requires the "Microsoft Office file malicious macro removal" policy to be enabled. The exact vulnerable Falcon Sensor version was not disclosed.

"FalconFlank is a zero-day privilege escalation that abuses the Office malicious macros remediation in CrowdStrike Falcon Sensor. Obviously by the time I drop this CrowdStrike would already have detections for it so if you want to test you either have to add it to the exclusions or obfuscate the PoC and change the dll load technique" — Chaotic Eclipse, GitHub README

The quote reveals operational awareness: the researcher assumes the vendor has already alerted its defenses, suggesting the PoC's specific DLL load technique may be detected. However, the underlying vulnerability — the fact that remediation performs attacker-controllable operations with SYSTEM privileges — persists regardless of the loading technique.

CrowdStrike's Response: Investigation and Temporary Mitigation

CrowdStrike issued an official statement through its spokesperson, reported by Infosecurity Magazine and SecurityWeek. The company confirmed it is "actively working on the reports" and provided immediate guidance to customers.

The mitigation consists of disabling the "Microsoft Office File Suspicious Macro Removal Windows" policy. At the same time, CrowdStrike reassured that protection remains active through the "Cloud Anti-malware for Microsoft Office Files settings" service. The Tech Alert named FalconFlank is accessible exclusively through the dedicated customer support portal, not publicly.

No CVE has been assigned to the vulnerability at the time of disclosure. No source reports the existence of an available or in-development patch.

The Nightmare Eclipse Pattern: Multi-Vendor Zero-Days as Systemic Pressure

FalconFlank is not an isolated event. In the same time window, Chaotic Eclipse published analogous zero-days against other security vendors: HardBreacher for Kaspersky (patched August 31), PrettyPrague for Avast (patched September 4), and GreenSection for Nvidia. SecurityWeek documented this sequence, placing it in a pattern of coordinated disclosure.

The researcher — also known as Nightmare Eclipse, Infinite Nightmare, and MSNightmare — has a documented history of vulnerabilities against Microsoft Defender. SecurityAffairs traced this genealogy: ShieldBreak (CVE-2026-69414, CVSS 7.8 HIGH), Undefend, RedSun, and LegacyHive. CVE-2026-69414 is cataloged with CVSS vector:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, confirming the nature of a local privilege escalation with high impact on confidentiality, integrity, and availability.

This multi-vendor disclosure strategy, close in time and public, acts as systemic pressure on an entire industry. The message is explicit: products designed to protect endpoints themselves constitute an attack surface, and their high-privilege architecture amplifies potential damage.

Immediate Actions

Disable the "Microsoft Office File Suspicious Macro Removal Windows" policy as indicated by CrowdStrike in the official statement of September 3, 2026.
Verify that "Cloud Anti-malware for Microsoft Office Files settings" is active to maintain antimalware protection on Office documents per the vendor's recommended configuration.
Consult the FalconFlank Tech Alert in the CrowdStrike support portal, accessible only to registered customers, for any non-public operational updates.
Assess exposure on Windows 11 25H2 and Windows Server 2025 endpoints configured with Phase 3 Optimal Protection, which represent the researcher's declared test conditions.

The EDR Paradox: When the Guardian Becomes the Danger

The FalconFlank incident fits into a broader crisis of confidence in EDR products, accelerated by the July 2024 incident that had already highlighted the risks of an architecture too deeply rooted in the system. The difference now is structural: this is not a deployment error, but a design vulnerability that exploits the remediation function itself.

The consequence for enterprises is twofold. On one hand, reliance on a single EDR agent with SYSTEM privileges exposes them to catastrophic failure when that agent is compromised. On the other, the required mitigation — disabling a protection feature — introduces an immediate trade-off between functional security and architectural security. The dossier documents no alternative containment strategies or compensation measures beyond the one indicated by CrowdStrike.

Kevin Beaumont's observation, shared on Mastodon in the context of the disclosure, summarizes the industry posture: "An open secret amongst security researchers is most cybersecurity products are crap at cybersecurity." His independent confirmation that "FalconFlank works" — lacking technical details but founded on the researcher's reputation — adds credibility to the threat without dispelling the unknowns that remain about the exact DLL loading mechanism and the completeness of detectable countermeasures.

Questions and Answers

Does the vulnerability affect all Falcon Sensor versions?: Chaotic Eclipse tested the PoC on Windows 11 25H2 and Windows Server 2025 with Phase 3 Optimal Protection configuration. No information emerges on other Windows versions, different configurations, or earlier sensor editions.
Is it necessary to completely disable CrowdStrike's macro protection?: CrowdStrike indicated exclusively disabling the "Microsoft Office File Suspicious Macro Removal Windows" policy, not macro protection in its entirety. The company specified that "Cloud Anti-malware for Microsoft Office Files settings" maintains coverage.
Did the researcher coordinate disclosure with the vendor?: The PoC publication occurs as a public zero-day, with the researcher consciously anticipating the existence of possible detections by CrowdStrike.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter