An anonymous researcher known as 'Nightmare Eclipse' released a zero-day exploit called 'FalconFlank' targeting CrowdStrike Falcon on Windows systems. The exploit enables privilege escalation to SYSTEM level on fully patched, up-to-date Windows machines. The vulnerability resides within the CrowdStrike Falcon security agent itself, which is widely deployed in enterprise environments. This is particularly concerning as Falcon is a trusted endpoint detection and response (EDR) tool, and a flaw within it could be leveraged to bypass security controls. The exploit was publicly released, increasing the risk of active exploitation in the wild. Organizations relying on CrowdStrike Falcon for endpoint security should monitor for patches and advisories from CrowdStrike. The public nature of the exploit code significantly raises the threat level for enterprise environments.
FalconFlank is a zero-day privilege escalation exploit targeting CrowdStrike Falcon Sensor. It abuses the Microsoft Office malicious macros remediation feature (File Suspicious Macro Removal) within CrowdStrike Falcon to spawn a command prompt with SYSTEM-level privileges. The exploit works on fully updated Windows 11 25H2 and Windows Server 2025 systems running the latest version of CrowdStrike Falcon. No CVE ID has been assigned yet. A public proof-of-concept (PoC) was released on GitHub by the researcher 'Nightmare Eclipse'. CrowdStrike has noted that by the time of disclosure, detections had already been added, requiring testers to either add exclusions or obfuscate the PoC and change the DLL load technique. The same researcher also released additional zero-day privilege escalation exploits this week: HardBreacher (Kaspersky Antivirus for Endpoint), PrettyPrague (GenDigital Avast Antivirus), and GreenSection (Nvidia denial-of-service/system crash). Cybersecurity expert Kevin Beaumont independently confirmed these privilege escalation exploits are functional. The researcher has previously disclosed multiple zero-days targeting Microsoft products including Defender, BitLocker, and Windows components (LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, UnDefend), some of which have been patched and some of which remain unpatched.
1. Disable the Microsoft Office 'File Suspicious Macro Removal' Windows policy setting as advised by CrowdStrike. 2. Ensure the 'Cloud Anti-malware for Microsoft Office Files' setting remains enabled in CrowdStrike Falcon as an alternative protection layer. 3. Review the FalconFlank Tech Alert on the CrowdStrike support portal (requires account login at supportportal.crowdstrike.com). 4. Monitor for any suspicious process spawning with SYSTEM privileges, particularly command prompts initiated from CrowdStrike Falcon processes. 5. Apply any available updates or patches from CrowdStrike as they become available. 6. Monitor for use of the public PoC available on GitHub (github.com/MSNightmare/FalconFlank) and watch for obfuscated variants or DLL load technique changes. 7. For Kaspersky and Avast users, monitor for the HardBreacher and PrettyPrague PoCs respectively and apply vendor mitigations when available. 8. For organizations using Nvidia products, monitor for the GreenSection DoS exploit.
GitHub repository: https://github.com/MSNightmare/FalconFlank, GitHub repository: https://github.com/MSNightmare/HardBreacher, GitHub repository: https://github.com/MSNightmare/PrettyPrague, GitHub repository: https://github.com/MSNightmare/GreenSection, GitHub repository: https://github.com/Nightmare-Eclipse/UnDefend, Exploit name: FalconFlank, Exploit name: HardBreacher, Exploit name: PrettyPrague, Exploit name: GreenSection, Twitter/X handle: MSNightmare2000
