FalconFlank Zero-Day Abuses CrowdStrike Falcon Macro Cleanup for Privilege Escalation

Security researcher Chaotic Eclipse has publicly released a new zero-day exploit dubbed FalconFlank, targeting a high-severity privilege escalation vulnerability in CrowdStrike Falcon Sensor. The exploit targets the endpoint protection software’s automated remediation mechanism for malicious Microsoft Office macros. The public release of the proof-of-concept (PoC) code on GitHub creates an immediate security concern for enterprise environments running CrowdStrike’s security suite on fully updated Windows 11 25H2 and Windows Server 2025 systems.

This CrowdStrike Falcon privilege escalation vulnerability allows low-privileged local users to abuse the elevated execution context of the security agent, manipulating its cleanup routines to achieve arbitrary file writes and system-level access.

Weaponizing EDR Remediation Routines

FalconFlank represents a recurring class of security software flaws: privilege escalation via remediation race conditions and file manipulation. Modern endpoint detection and response (EDR) platforms like CrowdStrike Falcon run with elevated system privileges (NT AUTHORITY\SYSTEM or kernel-level rights) to inspect runtime behavior, quarantine threats, and perform automated cleanup. When Falcon detects a threat, such as a malicious Office macro inside a document, it initiates an automated remediation sequence to sanitize or isolate the artifact.

Because the EDR agent operates with the highest local privileges on Windows, any file creation, move, or overwrite operation during remediation occurs with full system authority. If the software fails to strictly validate file paths, symbolic links, or NT Object Manager namespace objects before executing its clean routine, a local standard user can manipulate the underlying filesystem objects. By establishing symbolic links or junction points in a Time-of-Check to Time-of-Use (TOCTOU) race condition, an attacker can redirect Falcon’s privileged file write to drop an arbitrary payload into protected directories such as C:\Windows\System32. Once an attacker-controlled DLL is dropped into a system path, triggering a legitimate OS service that loads the library grants immediate administrative or SYSTEM execution.

Chaotic Eclipse’s Expanding Trail of Endpoint Zero-Days

The release of FalconFlank is part of an ongoing series of zero-day disclosures published by Chaotic Eclipse (who also operates under the aliases INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) targeting major endpoint security solutions:

• Kaspersky Endpoint Security (“HardBreacher”): Days prior to dropping FalconFlank, Chaotic Eclipse released a PoC for a privilege escalation flaw in Kaspersky Endpoint Security for Windows (version 14.0.0.504). Codenamed HardBreacher, the exploit forces Kaspersky’s remediation logic to drop C:\Windows\System32\MY_SNAKE_IS_SOLID.dll with full permissions granted to the current user. The researcher noted that taking control of the UI process causes the security application to fail, granting or blocking arbitrary file permissions and destabilizing OS operations.
• Microsoft Defender (“ShieldBreak” / CVE-2026-69414): Last month, the researcher published ShieldBreak, an LPE zero-day in Microsoft Defender assessed as a patch bypass for CVE-2026-50656 (RoguePlanet). Technical analysis from LevelBlue revealed that ShieldBreak combined the Cloud Files API, Object Manager namespace manipulation, direct Defender API invocation, and timing races in Defender’s clean engine. The technique redirected Defender to drop C:\Windows\System32\phoneinfo.dll, obtaining SYSTEM privileges through the Windows Error Reporting task.

In public posts dated August 14, 2026, Chaotic Eclipse expressed frustration regarding communication breakdowns with major vendors, claiming Microsoft refused to engage and restricted reporting channels. The researcher stated an explicit strategy to publish zero-day PoCs for third-party security software in windows prior to official Patch Tuesday updates.

Blast Radius and Enterprise Risk

Vulnerabilities that weaponize EDR agents pose a distinct risk to enterprise defenses. Security agents installed across entire workstation fleets effectively become vectors for privilege escalation if their internal remediation pipelines can be hijacked.

In a typical compromise chain, an adversary gains initial entry as an unprivileged user via phishing, stolen web credentials, or initial access malware. Restricting local administrator access normally prevents standard accounts from expanding control over the endpoint. FalconFlank breaks this trust boundary: a local user on a host running CrowdStrike Falcon Sensor can hijack the security tool’s own remediation routine to bypass Windows operating system access controls.

However, the researcher noted that testing the public PoC in its default state may trigger existing behavioral detection logic within CrowdStrike Falcon. Validating the vulnerability in a lab setting requires setting file or folder exclusions or obfuscating the PoC code and modifying the underlying DLL load technique.

Detection and Mitigation Recommendations

To protect endpoints against FalconFlank and similar EDR remediation exploitation techniques, security operations teams should implement the following targeted actions:

1. Maintain Cloud Telemetry and Detections: Ensure CrowdStrike Falcon Sensor endpoints maintain continuous connectivity to the CrowdStrike cloud platform. Behavioral detection mechanisms and cloud-managed protection rules are updated dynamically to detect anomalous macro cleanup patterns and unauthorized DLL creation.
2. Audit System32 DLL Drops: Configure File Integrity Monitoring (FIM) or endpoint logging to generate high-priority alerts whenever non-standard or unsigned DLLs (such as unexpected system library writes) are created in C:\Windows\System32\.
3. Enforce Application Control Rules: Implement Windows Defender Application Control (WDAC) or AppLocker policies to restrict the execution of unauthorized or unsigned DLLs residing in system directories, neutralizing the secondary code-execution stage of remediation hijacking.
4. Avoid Broad Exclusion Policies: Do not create broad exclusions in the CrowdStrike console for testing purposes, as suppressing behavioral monitoring disables the sensor’s native ability to block PoC execution patterns.