CrowdStrike probes privilege-escalation exploit disclosure

CrowdStrike is investigating a publicly released proof-of-concept exploit that a security researcher says can elevate local privileges to SYSTEM level on Windows machines running its Falcon endpoint sensor.

The exploit, dubbed FalconFlank, was published on GitHub on September 3 by a researcher using the names Nightmare Eclipse, Chaotic Eclipse and MSNightmare. The researcher described it as a zero-day privilege-escalation flaw that abuses Falcon Sensor’s Microsoft Office malicious-macro remediation function.

CrowdStrike has not publicly confirmed the underlying vulnerability. The company said it was actively investigating the claims and advised customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting while its review continued. It said customers remained protected through the Cloud Anti-malware for Microsoft Office Files setting and referred users to a FalconFlank technical alert available through its customer support portal.

The distinction is significant because the exploit has been labelled a zero day by its author and several security researchers, but CrowdStrike’s public statement stops short of validating that characterisation. No CVE identifier had been assigned to the issue as of September 7, and no public vendor advisory confirming a software defect or patch was available.

The researcher said the proof-of-concept works on fully updated Windows 11 25H2 and Windows Server 2025 systems configured with CrowdStrike Falcon’s Phase 3 Optimal Protection and the Office malicious-macro removal feature enabled. Independent security researcher Kevin Beaumont said he had confirmed that the CrowdStrike exploit worked, adding weight to the technical claim while not replacing formal vendor verification.

FalconFlank is a local privilege-escalation technique rather than a remote-access exploit. That means an attacker would generally need an existing foothold or the ability to execute code with lower privileges before attempting to use the flaw to obtain SYSTEM rights, the highest routine privilege level on Windows. Such escalation can materially increase an attacker’s ability to tamper with security controls, access protected resources or move deeper into a compromised environment.

The public release of working proof-of-concept code increases the urgency for organisations using the affected configuration because defenders and attackers can inspect the same technical material. The GitHub repository identifies the Office macro-remediation process as the element being abused, while CrowdStrike’s mitigation advice specifically directs customers to switch off that policy setting pending further investigation.

CrowdStrike has not said publicly whether it has observed malicious exploitation outside testing. The researcher also suggested the company could already have detections for the published proof-of-concept, but that assertion has not been independently confirmed by CrowdStrike. Detection of a specific exploit sample would also be distinct from fixing any underlying product weakness.

CrowdStrike has also not disclosed affected Falcon Sensor versions, exploitation telemetry, or a timetable for completing its investigation, leaving customers dependent on interim configuration guidance.

The episode comes amid a burst of disclosures by the same researcher involving endpoint-security and graphics software from several vendors. Those disclosures include privilege-escalation proof-of-concept code affecting Avast and Kaspersky products and a separate issue involving Nvidia software. Gen Digital, which owns Avast, said it had addressed a vulnerability affecting a subset of its products, while Kaspersky said it had delivered a fix for the flaw disclosed against its endpoint product.

The CrowdStrike case is drawing particular attention because endpoint detection and response software typically operates with deep system privileges to inspect files, processes and other activity. Security products with that level of access can become valuable targets if an attacker finds a way to manipulate privileged remediation or scanning functions.

The Falcon Sensor is a core component of CrowdStrike’s endpoint-security platform, which is widely deployed across corporate Windows environments. The claimed weakness concerns a feature intended to remove suspicious macros from Microsoft Office files, illustrating how remediation mechanisms themselves can require careful privilege boundaries.