CrowdStrike FalconFlank Zero-Day EDR Platform Exploited

An anonymous security researcher operating under the handle “Nightmare Eclipse” has released a zero-day privilege escalation exploit targeting CrowdStrike Falcon, the widely deployed endpoint detection and response (EDR) platform. The exploit, dubbed “FalconFlank,” enables attackers to escalate privileges to SYSTEM level on fully patched Windows 11 and Windows Server 2025 systems. This disclosure comes amid an escalating series of zero-day releases from the same researcher targeting multiple security and software vendors.

What Happened: CrowdStrike FalconFlank Zero-Day Grants SYSTEM Privileges

Nightmare Eclipse published the FalconFlank proof-of-concept on September 4, 2026, via their GitHub repository and social media channels. Furthermore, the researcher claims the exploit works against up-to-date installations of Windows 11 25H2 and Windows Server 2025 running the latest CrowdStrike Falcon Sensor.

The attack abuses CrowdStrike Falcon’s Office malicious macro remediation feature. Consequently, an attacker with initial access can spawn a command prompt with SYSTEM privileges by manipulating this remediation workflow. Kevin Beaumont, a widely respected cybersecurity expert, independently confirmed that the exploit is real and functional.

CrowdStrike has acknowledged the claims and is actively investigating. However, no CVE identifier has been assigned to the vulnerability as of this publication.

Technical Details of the FalconFlank Exploit

FalconFlank targets the File Suspicious Macro Removal component within CrowdStrike Falcon Sensor. This feature is designed to protect Microsoft Office users by detecting and removing potentially malicious macros from documents. However, the remediation mechanism itself can be weaponized to achieve privilege escalation.

The exploit chain works as follows:

• An attacker leverages the Office macro remediation process to load a malicious DLL
• The DLL is executed in the context of the Falcon Sensor service, which runs with elevated privileges
• This grants the attacker SYSTEM-level access without requiring prior admin credentials

Affected Systems and Configurations

The researcher confirmed FalconFlank works on fully patched systems running:

• Windows 11 25H2
• Windows Server 2025
• Latest CrowdStrike Falcon Sensor versions

CrowdStrike has published a technical alert in its support portal, though it remains accessible only to authenticated customers.

Business and Operational Impact

The FalconFlank zero-day presents a significant risk to organizations relying on CrowdStrike Falcon for endpoint protection. Moreover, the vulnerability turns a trusted security control into an attack vector.

Key impacts include:

• Trusted security tool compromised: Attackers can exploit the very EDR platform meant to detect and stop them
• Silent privilege escalation: SYSTEM access can be obtained without triggering typical detection patterns
• Wide attack surface: Any organization running CrowdStrike Falcon with Office macro remediation enabled is potentially vulnerable
• Lateral movement risk: SYSTEM-level access enables credential theft, persistence, and network traversal

Therefore, defenders must treat this as an active threat even though no in-the-wild exploitation has been publicly confirmed yet. The availability of a working proof-of-concept significantly lowers the barrier to entry for threat actors.

Mitigation and Recommendations

CrowdStrike has issued interim guidance while a formal patch is developed. Organizations should take immediate steps to reduce exposure.

Immediate Actions for Defenders

1. Disable the File Suspicious Macro Removal policy: CrowdStrike advises customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting immediately
2. Enable Cloud Anti-malware for Office Files: This alternative setting provides protection without exposing the vulnerable remediation path
3. Monitor for suspicious DLL loads: Security teams should watch for unusual DLL loading activity associated with Falcon Sensor processes
4. Apply CrowdStrike updates when available: A formal patch is expected; monitor the CrowdStrike support portal for patch notifications

Long-Term Recommendations

In addition to immediate mitigations, organizations should review their EDR security posture. Consider the following:

• Segment critical systems to limit lateral movement after privilege escalation
• Implement application control policies to restrict unauthorized DLL execution
• Review and strengthen monitoring around EDR agent integrity and behavior
• Ensure incident response playbooks account for compromised security tooling

Bottom line: Disable CrowdStrike’s Office macro remediation feature now. The FalconFlank exploit turns your EDR into an attack vector, and waiting for an official patch without taking interim steps is an unacceptable risk.

Incident Summary

CVE ID / Incident:	FalconFlank Zero-Day (CVE pending)
Affected Systems:	Windows 11 25H2, Windows Server 2025 with CrowdStrike Falcon Sensor
Disclosure Date:	September 4, 2026
Patch Status:	Under investigation; interim mitigation available
CVSS Score:	Not yet assigned
Researcher:	Nightmare Eclipse (anonymous)

Context: A Week of Zero-Day Disclosures

The FalconFlank disclosure is part of a broader campaign by Nightmare Eclipse. In the same week, the researcher published privilege escalation zero-days targeting Kaspersky Antivirus for Endpoint (HardBreacher) and GenDigital Avast Antivirus (PrettyPrague), as well as a denial-of-service exploit for Nvidia drivers (GreenSection).

Since April 2026, Nightmare Eclipse has disclosed multiple Microsoft product zero-days including LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend. Some have been patched; others remain zero-days awaiting official fixes.

References

1. BleepingComputer, “New CrowdStrike ‘FalconFlank’ zero-day grants SYSTEM privileges,” Lawrence Abrams, September 4, 2026, https://www.bleepingcomputer.com/news/security/new-crowdstrike-falconflank-zero-day-grants-system-privileges/, accessed September 4, 2026.
2. Nightmare Eclipse GitHub Repository, “FalconFlank,” https://github.com/MSNightmare/FalconFlank, accessed September 4, 2026.
3. Kevin Beaumont (@GossiTheDog), Cyberplace.social confirmation of exploit validity, September 4, 2026, https://cyberplace.social/@GossiTheDog/117207575150746857, accessed September 4, 2026.
4. CrowdStrike Support Portal, “Tech Alert: FalconFlank Research,” https://supportportal.crowdstrike.com, accessed September 4, 2026.