FalconFlank: Unpatched Local Privilege Escalation PoC in CrowdStrike Falcon Sensor via Office Macro Remediation
FalconFlank: Unpatched Local Privilege Escalation PoC in (TL-2026-2330), also tracked as FalconFlank, is a high-severity software vulnerability, first published 2026-09-04. It is attributed to Chaotic Eclipse with high confidence, affects CrowdStrike Falcon Sensor, maps to 8 MITRE ATT&CK techniques (T1003.002, T1027, T1059.003), and is covered by 9 detection rules and 22 indicators of compromise.
Key facts for TL-2026-2330
- Threat ID
- TL-2026-2330
- Also known as
- FalconFlank
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-09-04
- Last reviewed
- 2026-09-04
- Attribution
- Chaotic Eclipse
- Attribution confidence
- HIGH
- Motivation
- UNKNOWN
- Target sectors
- government administration, financial-services, health, technology, critical-infrastructure, defense-industrial-base
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in FalconFlank: Unpatched Local Privilege Escalation PoC in
Malware and tooling: BlueHammer, FalconFlank, GreatXML, GreenPlasma, GreenSection, HardBreacher, LegacyHive, PrettyPrague, RedSun, RoguePlanet, ShieldBreak, Undefend
Security researcher Chaotic Eclipse (aka MSNightmare, Nightmare-Eclipse, INFINITE NIGHTMARE) published FalconFlank, an unpatched, un-CVE'd PoC that abuses CrowdStrike Falcon Sensor's Office malicious-macro remediation feature to spawn a SYSTEM-privileged command prompt on fully updated Windows 11 25H2 / Windows Server 2025 running Falcon Phase 3 Optimal Protection. CrowdStrike has not confirmed the flaw but is investigating and has issued interim guidance to disable the vulnerable policy setting. FalconFlank is the researcher's fourth publicized EDR/AV local-privilege-escalation disclosure in as many weeks, following ShieldBreak (CVE-2026-69414, Microsoft Defender), HardBreacher (Kaspersky Endpoint Security), and PrettyPrague (Avast Antivirus) -- itself one release in a much larger, ongoing campaign of at least thirteen public zero-day PoCs since roughly early April 2026.
How FalconFlank: Unpatched Local Privilege Escalation PoC in works
FalconFlank is a publicly released, MIT-licensed proof-of-concept exploit (github.com/MSNightmare/FalconFlank) that abuses CrowdStrike Falcon Sensor's 'Microsoft Office file malicious macro removal' remediation feature to locally escalate privileges to SYSTEM on fully updated Windows 11 25H2 and Windows Server 2025 hosts running Falcon with Phase 3 Optimal Protection. No CVE has been assigned and CrowdStrike has not confirmed the vulnerability as of publication, but the vendor acknowledged it is actively investigating the claims.
Mechanically, the flaw turns a defensive workflow against itself: Falcon's Office malicious-macro remediation process operates with elevated (SYSTEM-level) rights, and the PoC's author states the exploit works by manipulating the DLL the remediation workflow loads ('change the dll load technique'), consistent with a DLL-hijacking/side-loading technique that lets a low-privileged local process ride the elevated remediation process to code execution, ultimately spawning a SYSTEM-privileged Windows command prompt. Exploitation requires local code-execution capability or an existing local account on the target and depends on the 'Microsoft Office file malicious macro removal' policy being enabled. The researcher notes that by the time of public release CrowdStrike would likely already detect the unmodified PoC, so successful testing requires either adding Falcon exclusions or obfuscating/re-tooling the DLL-load stage -- an explicit acknowledgment that the technique is evadable but not neutralized by disclosure alone.
CrowdStrike's public response, delivered through a FalconFlank Tech Alert on its support portal, is to advise customers to disable the 'Microsoft Office File Suspicious Macro Removal' Windows policy setting while noting that customers remain protected through Falcon's separate Cloud Anti-malware for Microsoft Office Files setting. No patch or CVE had been issued as of the most recent coverage; independent validation of the PoC's reliability is still pending.
FalconFlank is not an isolated release. The same researcher, operating under the aliases Chaotic Eclipse, MSNightmare, Nightmare-Eclipse, and INFINITE NIGHTMARE, has run a rapid-fire campaign of local-privilege-escalation disclosures against major endpoint security vendors in the weeks prior: ShieldBreak (CVE-2026-69414, a Microsoft Malware Protection Engine flaw bypassing the earlier RoguePlanet patch, CVE-2026-50656, disclosed 2026-08-14), HardBreacher (a Kaspersky Endpoint Security for Windows 14.0.0.504 privilege-escalation PoC published 2026-08-29 that the researcher themselves described as 'duct-taped' together, and which the researcher states can also crash Kaspersky's UI process or arbitrarily grant/block file access), and PrettyPrague (a GenDigital Avast Antivirus sandbox-abuse PoC published 2026-09-01 that dumps the Windows SAM database for a SYSTEM shell, claimed to work on any Avast version and suspected to extend to AVG and Norton). SecurityWeek reporting indicates the researcher began this release cadence out of frustration with Microsoft's handling of prior vulnerability reports, and that at least some of the earlier PoCs from this same researcher have subsequently been observed exploited in the wild by unrelated malicious actors -- a material consideration for defenders even though FalconFlank itself has no confirmed active exploitation yet.
The FalconFlank/HardBreacher/PrettyPrague trio is itself only the latest wave of a much larger campaign: Nightmare Eclipse has publicly released at least thirteen zero-day proofs-of-concept since roughly early April 2026 -- BlueHammer (CVE-2026-33825), RedSun, UnDefend, GreenPlasma, RoguePlanet, YellowKey, GreatXML, LegacyHive, ShieldBreak, HardBreacher, PrettyPrague, GreenSection, and FalconFlank -- the large majority against Microsoft Windows/Defender components, with the most recent releases pivoting to third-party endpoint-security vendors (Kaspersky, Avast, CrowdStrike) and, with GreenSection, to NVIDIA GPU drivers outside the security-software space entirely. The Register and SecurityWeek both characterize the researcher as 'disgruntled,' openly running the disclosure spree as an adversarial campaign against Microsoft's vulnerability-handling and bug-bounty practices rather than for financial, ideological, or nation-state motives. RoguePlanet, the immediate predecessor in this lineage, itself weaponized a Time-of-Check-to-Time-of-Use (TOCTOU) race condition in Defender's SYSTEM-privileged quarantine pipeline -- staging an NTFS junction/symlink path redirection so a privileged writer follows the link to an attacker-controlled destination -- to spawn a SYSTEM command prompt; Microsoft assigned it CVE-2026-50656 and shipped a fix (Malware Protection Engine 1.1.26060.3008) on 2026-07-08, which ShieldBreak subsequently bypassed. This lineage matters for FalconFlank because it establishes the researcher's demonstrated, repeatable pattern: turn a security product's own SYSTEM-privileged remediation/quarantine workflow into a local privilege-escalation primitive, then repeat against the next vendor once a patch lands.
Because the PoC source is public and MIT-licensed, and because the underlying class of bug (a security product's own elevated remediation workflow being turned into a local privilege-escalation primitive) has now been demonstrated against three major endpoint security vendors in one month on top of a long-running string of Microsoft-focused disclosures, defenders running CrowdStrike Falcon should treat this as an actionable exposure regardless of CVE status.
MITRE ATT&CK techniques used in TL-2026-2330
Credential Access
T1003.002 Security Account Manager
Defense Evasion
T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion
Execution
T1059.003 Windows Command Shell
Initial Access
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
stealth
defense-impairment
Affected products and versions in FalconFlank: Unpatched Local Privilege Escalation PoC in
- CrowdStrike — Falcon Sensor
Vulnerable versions: Falcon Sensor with Phase 3 – Optimal Protection enabled on fully updated Windows 11 25H2 and Windows Server 2025 (specific sensor build not disclosed by researcher or vendor)
Remediation for FalconFlank: Unpatched Local Privilege Escalation PoC in
Immediate actions
- Disable the 'Microsoft Office File Suspicious Macro Removal' Windows policy setting for Falcon Sensor per CrowdStrike's interim guidance
- Confirm Falcon's Cloud Anti-malware for Microsoft Office Files protection remains enabled as the compensating control while Suspicious Macro Removal is disabled
- Review CrowdStrike's FalconFlank Tech Alert in the support portal for the latest guidance, IOCs, and any released detections
Workarounds
- If disabling the Suspicious Macro Removal policy is not immediately operationally feasible, add compensating EDR/SIEM detection and alerting around Falcon Office-macro remediation events and unexpected SYSTEM-privileged command-shell spawns
Longer-term hardening
- Apply CrowdStrike's official sensor update once a fix is released and confirmed to resolve the underlying remediation-workflow flaw
- Track CrowdStrike advisories for CVE assignment and revise the mitigation posture (re-enabling Suspicious Macro Removal) once patched
- Restrict local administrative rights and monitor for anomalous SYSTEM-level cmd.exe spawns tied to security-tool remediation processes as a general LPE hardening measure
- Given the researcher's demonstrated pattern of repeatedly targeting each vendor's own elevated remediation/quarantine workflow, extend the same detection logic (unexpected SYSTEM-privileged process spawns from security-tool remediation paths) to other installed EDR/AV products, not just Falcon
Timeline of FalconFlank: Unpatched Local Privilege Escalation PoC in
- Nightmare Eclipse publishes the RoguePlanet PoC hours after Microsoft's June 2026 Patch Tuesday, weaponizing a TOCTOU race condition in Microsoft Defender's SYSTEM-privileged quarantine pipeline (via NTFS junction/symlink path redirection) to spawn a SYSTEM command prompt -- the direct predecessor to the remediation-workflow-abuse pattern later reused in ShieldBreak and FalconFlank.
- Microsoft ships Malware Protection Engine version 1.1.26060.3008, patching CVE-2026-50656/RoguePlanet.
- Researcher releases LegacyHive, a Windows User Profile Service hive-loading local privilege-escalation PoC that allows loading other users' registry hives including administrators'; the released version is deliberately stripped of full functionality to reduce in-the-wild exploitation risk. Release coincides with July 2026 Patch Tuesday.
- Researcher publicly discloses ShieldBreak without prior notification to Microsoft, bypassing the RoguePlanet/CVE-2026-50656 patch to again spawn a SYSTEM command prompt via the Microsoft Malware Protection Engine, establishing the pattern of EDR/AV remediation-workflow abuse later reused in FalconFlank.
- Microsoft assigns CVE-2026-69414 (CVSS 3.1 base score 7.8, HIGH; CWE-284 Improper Access Control) to the ShieldBreak Defender flaw; no patch is issued at assignment time.
- Researcher publishes the HardBreacher PoC repository (MSNightmare/HardBreacher) targeting Kaspersky Endpoint Security for Windows 14.0.0.504 privilege escalation on Windows 11 25H2, describing the PoC itself as 'duct-taped' together.
- SecurityWeek and SecurityAffairs report on the HardBreacher release and the researcher's broader disclosure campaign against endpoint security vendors.
- Researcher publishes PrettyPrague, abusing a vulnerability in the Avast Sandbox to dump the Windows SAM database and spawn a full SYSTEM shell; claimed to work on any Avast Antivirus version on fully patched Windows 11 25H2, and suspected by the researcher to extend to GenDigital's AVG and Norton products.
- The Register and The Hacker News publish initial coverage of the FalconFlank PoC release; The Register additionally profiles the researcher's total campaign history dating to early April 2026.
- The Register reports the researcher's concurrent release of GreenSection, an NVIDIA GPU-driver memory-corruption 0day abusing a shared global memory section to cause out-of-bounds writes affecting Vulkan/OpenGL applications -- the researcher's first public disclosure outside Microsoft/EDR-AV targeting; per analyst Kevin Beaumont the bug crashes the system rather than granting SYSTEM privileges, and NVIDIA had not responded to inquiries as of reporting.
- Chaotic Eclipse (MSNightmare) publishes the FalconFlank PoC on GitHub, demonstrating a SYSTEM-privileged command-prompt spawn via abuse of CrowdStrike Falcon Sensor's Office malicious-macro remediation feature on Windows 11 25H2 / Windows Server 2025.
- CrowdStrike publicly acknowledges it is investigating the FalconFlank claims and issues interim mitigation guidance (disable the Microsoft Office File Suspicious Macro Removal policy setting) via a FalconFlank Tech Alert on its support portal; no CVE or patch issued.
- BleepingComputer, SecurityAffairs, Techzine, GBHackers, and CyberSecurityNews publish corroborating coverage of the FalconFlank disclosure, confirming the Falcon Phase 3 Optimal Protection scope and lack of CVE.
Sources cited for FalconFlank: Unpatched Local Privilege Escalation PoC in
- New CrowdStrike FalconFlank zero-day grants SYSTEM privileges
- Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon
- MSNightmare/FalconFlank
- Chaotic Eclipse Releases Crowdstrike Falcon ZeroDay FalconFlank
- FalconFlank exposes CrowdStrike Falcon privilege flaw
- CrowdStrike Falcon Zero-Day Lets Attackers Escalate Privileges
- Researcher Claims CrowdStrike Falcon 0-Day Privilege Escalation Vulnerability
- Nightmare Eclipse Drops 'HardBreacher' Kaspersky Product Exploit
- Chaotic Eclipse Releases Kaspersky Zero-Day HardBreacher
- Chaotic Eclipse Releases GenDigital Avast Antivirus ZeroDay PrettyPrague
- Microsoft working on Defender patch for ShieldBreak zero-day
- CVE-2026-69414 Detail
- Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC
- RoguePlanet: Anatomy of the Nightmare Eclipse Microsoft Defender Zero-Day
- Nightmare Eclipse Drops 'LegacyHive' Windows Zero-Day
More in vulnerability
- VLC Media Player: Integer Overflow in AllocatePicture (CVE-2026-56711) and RTSP Heap Out-of-Bounds Read (CVE-2026-73324)
- Dutch NCSC Warns of Critical Check Point VPN Flaws (CVE-2026-85102, CVE-2026-85103) — Exploitation Expected Imminently
- GitLab Patches Max-Severity Unauthenticated Path Traversal Flaw in Repository Commits API (CVE-2026-85706, CVSS 10.0)
- CVE-2026-0310: PAN-OS XML Processing Out-of-Bounds Write Enables Unauthenticated Root RCE
- Endor Labs Discloses 14 Critical/High Vulnerabilities Across Seven AI Orchestration Platforms (NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, Apache Airflow)
Detection coverage for TL-2026-2330
As of 2026-09-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2330 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.