A researcher going by Chaotic Eclipse has published a working proof-of-concept, dubbed FalconFlank, for a local privilege escalation zero-day in CrowdStrike Falcon Sensor on Windows. The PoC reportedly lets a low-privileged local user reach SYSTEM on fully updated Windows 11 25H2 and Windows Server 2025 hosts running Falcon with Phase 3 Optimal Protection. As of this writing CrowdStrike has not assigned a CVE, published a CVSS score, or shipped a fix — customers have a configuration workaround only.

What happened

FalconFlank targets Falcon’s malicious Microsoft Office macro removal capability. When Falcon detects a suspicious macro embedded in an Office document, a remediation routine runs with elevated (SYSTEM-level) privileges to strip or quarantine the offending content. The researcher’s claim is that this cleanup path can be tricked into operating on an attacker-controlled file outside the intended scope — the classic shape of a privileged-file-operation bug, where a low-integrity process plants or redirects a file and waits for a high-integrity handler to act on it unsafely (race condition or insufficient path/ownership validation before the privileged operation executes).

The net effect: a local, unprivileged user who can place a file and trigger Falcon’s remediation logic gets code execution or file manipulation at SYSTEM level. That converts a single-user foothold into full host compromise — no exploit chain against Windows itself required, no additional CVE needed. The attack surface is entirely inside the security product meant to prevent exactly this kind of escalation.

The PoC is public on GitHub (MSNightmare/FalconFlank) and multiple outlets, including The Hacker News, The Register, and SecurityAffairs, reproduced coverage of the researcher’s claims as of September 3, 2026. Independent confirmation of the exact exploitation primitive and reliability across environments is still limited — this is a researcher disclosure with a working demo, not yet a vendor-confirmed vulnerability with a patch timeline.

Affected versions

  • CrowdStrike Falcon Sensor for Windows, specifically hosts with the “Microsoft Office file malicious macro removal” prevention policy setting enabled
  • Demonstrated against Windows 11 25H2 and Windows Server 2025, fully patched, running Falcon with Phase 3 Optimal Protection active
  • No CVE identifier has been assigned; CrowdStrike has not published an advisory confirming scope beyond this configuration

Impact

Falcon Sensor is deployed across a large share of enterprise and government Windows fleets specifically to prevent local compromise from escalating. A reliable local-to-SYSTEM primitive inside the EDR agent itself is high-value to any attacker who already has a foothold — post-phishing, post-RDP-brute-force, post-supply-chain-drop — because it turns “one compromised low-priv account” into “full host takeover, including the ability to tamper with or blind the security agent watching for exactly that.” Organizations running Falcon as their primary EDR on Windows endpoints, including regulated and critical-infrastructure environments where CrowdStrike is a common baseline control, should treat this as an active threat to triage now rather than wait for a CVE to materialize — public PoCs have a short shelf life before commodity actors incorporate them into post-exploitation toolkits.

Mitigation

CrowdStrike’s guidance, per reporting, is to disable the “Microsoft Office File Suspicious Macro Removal” Windows policy setting in the Falcon console. CrowdStrike states that Cloud Anti-Malware protection for Microsoft Office files remains active and continues to provide detection coverage even with this specific remediation setting turned off, so disabling it is not a full protection downgrade.

Additional steps while a fix is pending:

  • Audit which host groups have the macro-removal policy setting enabled and disable it fleet-wide until CrowdStrike ships a patch.
  • Restrict local administrative rights where possible — the attack requires local code execution, so reducing the population of users who can run arbitrary code locally shrinks the exposed population.
  • Keep attack-surface-reduction rules, application control, and Office macro restrictions (block macros from the internet, disable macros in untrusted locations) in place as defense in depth — they reduce the odds of the initial macro-drop step that would trigger Falcon’s remediation path in the first place.
  • Maintain endpoint logging and monitor for anomalous SYSTEM-level process creation tied to the Falcon remediation service, in case exploitation attempts are already occurring.
  • Watch for a CrowdStrike advisory and CVE assignment, and apply the vendor patch as soon as one ships.

Sources: The Hacker News, The Register, SecurityAffairs, SOCRadar.