Vulnerabilities

CrowdStrike Falcon Has a New 0-Day Problem. The PoC Is Already Public

September 3, 2026September 3, 2026

4 mins

The Mess: Security researcher Chaotic Eclipse has published FalconFlank, a public proof-of-concept claiming a zero-day privilege-escalation flaw in CrowdStrike Falcon Sensor. The exploit targets Falcon’s remediation process for malicious Microsoft Office macros and reportedly works against fully updated Windows 11 25H2 and Windows Server 2025 systems.
The Damage: If the claim holds, a local low-privileged attacker could abuse a security product running with elevated privileges and turn Falcon’s own remediation machinery into a privilege-escalation path.
The Fix: There is no public CVE or vendor patch confirmed at the time of writing — administrators should monitor CrowdStrike’s security advisories, review Falcon detections and consider temporarily disabling the affected Office macro-remediation capability if their risk assessment allows it.

The irony is almost too clean.

CrowdStrike Falcon exists to stop attackers from doing exactly this. FalconFlank allegedly abuses one of the platform’s defensive mechanisms to gain additional privileges on Windows.

Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, published the FalconFlank project on GitHub on September 3. The researcher describes it as a 0-day privilege-escalation vulnerability affecting CrowdStrike Falcon Sensor. The published repository contains source code, a Visual Studio project and an x64 release.

The claimed attack path involves Falcon’s “Microsoft Office file malicious macro removal” functionality. That feature is part of Falcon’s remediation workflow, meaning the security product itself performs actions on files with elevated privileges.

That creates an ugly security boundary.

An attacker who can influence what Falcon processes during remediation may be able to make the security software perform an operation that benefits the attacker instead of removing the threat.

According to the researcher, FalconFlank works on a fully updated Windows 11 25H2 system and Windows Server 2025 with CrowdStrike Falcon configured for Phase 3 Optimal Protection and Microsoft Office malicious-macro removal enabled.

There is another uncomfortable detail: the exploit is public.

The GitHub repository is not merely a description of a theoretical bug. It contains implementation code, making independent verification considerably easier. The researcher also warns that Falcon may already have detections capable of catching the published PoC.

That does not make the problem disappear.

It means defenders now have two separate questions to answer: whether FalconFlank is technically valid across affected configurations, and whether attackers can modify the published technique enough to evade existing detections.

As of September 3, there is no publicly assigned CVE and no confirmed CrowdStrike security advisory describing FalconFlank. The Hacker News reported that CrowdStrike had been contacted for comment.

The timing is also notable. CrowdStrike is currently holding Fal.Con 2026 in Las Vegas, with the conference running through September 3. The company has been heavily promoting Falcon’s new AI and autonomous-security capabilities during the event.

So while CrowdStrike talks about using agents to stop machine-speed attacks, a researcher has dropped a public PoC targeting the privileges of the Falcon endpoint agent itself.

That is the part defenders should pay attention to.

EDR products are powerful precisely because they operate with powerful privileges. They inspect files, terminate processes, quarantine content and perform automated remediation. Those capabilities are necessary for endpoint protection — but every privileged operation also becomes potential attack surface.

FalconFlank is therefore bigger than one unconfirmed zero-day claim.

If the vulnerability is validated, it is another example of the security-tool paradox: the software installed to protect the endpoint can become part of the attack chain.

Bugstoday’s take: A public PoC against an EDR running with elevated privileges deserves immediate attention even before the CVE number arrives. We would rather see administrators investigate a credible claim early than wait for attackers to turn it into a confirmed incident. Security software gets trusted by default. That trust is exactly why bugs inside it can hurt more than ordinary application flaws.

Today’s Bugs. Tomorrow’s Breaches.