FalconFlank: CrowdStrike Falcon 0-Day PoC

FalconFlank is an alleged privilege escalation zero-day vulnerability in CrowdStrike Falcon Sensor for Windows, published with working Proof-of-Concept (PoC) code by researcher Chaotic Eclipse. The concern: a security product running with elevated privileges may be tricked, through its own malicious-macro remediation workflow, into acting on an attacker’s behalf.

As of September 3, 2026, CrowdStrike has not confirmed the flaw, assigned a CVE, issued a CVSS score, nor shipped a fix. Here is what’s known about the scope, root cause, exploitation status, and what defenders should do now.

What Is FalconFlank?

FalconFlank is a reported attack path involving Falcon’s capability to remove malicious Microsoft Office macros during remediation. That cleanup mechanism runs with elevated privileges and could allegedly be tricked into handling attacker-controlled files unsafely, allowing a lower-privileged local user to persuade the security software to act on their behalf. The boundary crossed is the gap between what a standard user can do and what a security service with elevated system access can perform.

The MSNightmare/FalconFlank GitHub repository describes the issue as a “CrowdStrike Falcon 0-day Privilege Escalation Vulnerability” and includes C++ PoC code that interacts with named pipes, reparse points, DLL operations, and Windows system APIs. The researcher claims it works under the stated conditions, but independent reproduction and the resulting privilege level remain unconfirmed.

While the public PoC supports the attack concept, it does not independently prove that Falcon is vulnerable. The precise root cause – whether a bad security descriptor, race condition, unsafe file resolution, or another trust-boundary failure – remains undocumented, and no CVE, CWE, or severity rating exists yet.

Who Disclosed FalconFlank?

FalconFlank was published by a researcher going by Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse – a name behind a string of prior uncoordinated Windows and Defender zero-days, including the BitLocker bypass YellowKey, the Defender flaw RoguePlanet, and the profile-service bug LegacyHive, typically released with public PoC code and no advance vendor notice after a public falling-out with Microsoft. Several prior disclosures were later confirmed and patched; a few were reportedly exploited in the wild first.

Most recently, the same researcher also published HardBreacher, an alleged elevation of privilege zero-day in Kaspersky Endpoint Security, with a PoC described as unstable but reproducible on a fully patched Windows 11 25H2 machine.

Which CrowdStrike Falcon Versions Are Affected?

No affected version range has been published; the available reporting points to OS and policy conditions rather than a specific sensor build. Reportedly, the public PoC was tested against:

• Fully updated Windows 11 25H2 systems
• Windows Server 2025 systems
• Falcon configured with Phase 3 Optimal Protection
• The Microsoft Office file malicious macro removal capability enabled

It is unclear whether all Falcon releases are affected, and there is no evidence Falcon Sensor for macOS or Linux is involved. Treat these as exposure-prioritization criteria, not a confirmed affected-product list. Exploitability may also hinge on local access and other undocumented conditions.

How Could FalconFlank Be Exploited in Practice?

FalconFlank appears to require local code execution first. The public material doesn’t describe a remote, unauthenticated attack. An attacker would need to already be on a Windows host with Falcon enabled and the remediation capability active, then manipulate the file-handling sequence so Falcon performs a privileged action on attacker-controlled content. The precise prerequisites remain unclear, but this dependency on prior local access means FalconFlank is more relevant after phishing or malware execution than as a standalone remote entry point.

Is FalconFlank Actively Exploited?

No confirmed in-the-wild exploitation was identified in the reviewed reporting or independent searches as of September 3, 2026, and no victims or threat actors have been associated with FalconFlank.

The public exploit code raises weaponization risk, but FalconFlank should be treated as publicly disclosed and potentially serious, not actively exploited.

SOCRadar Cyber Threat Intelligence module can help your team monitor new reporting and exploitation status for FalconFlank, while Attack Surface Management (ASM) can help identify exposed Windows 11 25H2 and Server 2025 assets running Falcon.

What Should Defenders Do Right Now?

No public CrowdStrike patch, fix, or validated workaround was identified. Defenders should combine exposure assessment, vendor monitoring, access reduction, and targeted hunting.

How Should Organizations Prioritize Mitigation?

• Identify exposed systems: Inventory endpoints running Falcon with Phase 3 Optimal Protection and macro removal enabled.
• Monitor official guidance: Contact CrowdStrike support and watch official advisories.
• Apply the vendor fix when available: Upgrade Falcon Sensor per CrowdStrike’s instructions.
• Reduce local privilege: Restrict unnecessary admin rights, since the attack path requires local execution.
• Use defense in depth: Keep application control, macro restrictions, attack-surface-reduction rules, and endpoint logging in place.
• Avoid broad protection changes: Disabling Falcon isn’t a validated workaround. Test only on isolated, authorized systems.

What Should Defenders Hunt For?

• Office macro-remediation events followed by unusual process creation or privilege changes
• Unexpected DLL creation tied to Falcon remediation activity
• Suspicious file operations involving temporary paths, reparse points, or protected Windows locations
• Standard-user processes interacting with Falcon-related files, services, or named pipes
• Unexpected Falcon service restarts, tampering, or policy changes

The public code creates or uses a named pipe containing the string FALCONFLANK – a low-confidence lead, not a definitive indicator of compromise. No official Sigma rule or vendor detection logic has been published.

The appropriate response is exposure review and vendor monitoring, not broad protective changes. A flaw in an endpoint security product could have outsized impact, but FalconFlank remains unconfirmed by the vendor, lacks a CVE and severity rating, and has no confirmed exploitation. Patch when guidance arrives; until then, reduce local privilege, limit exposure, and hunt for related behavior.