# FalconFlank: Unpatched Local Privilege Escalation PoC in CrowdStrike Falcon Sensor via Office Macro Remediation

> Security researcher Chaotic Eclipse (aka MSNightmare, Nightmare-Eclipse, INFINITE NIGHTMARE) published FalconFlank, an unpatched, un-CVE'd PoC that abuses CrowdStrike Falcon Sensor's Office malicious-macro remediation feature to spawn a SYSTEM-privileged command prompt on fully updated Windows 11 25H2 / Windows Server 2025 running Falcon Phase 3 Optimal Protection. CrowdStrike has not confirmed the flaw but is investigating and has issued interim guidance to disable the vulnerable policy setting. FalconFlank is the researcher's fourth publicized EDR/AV local-privilege-escalation disclosure in as many weeks, following ShieldBreak (CVE-2026-69414, Microsoft Defender), HardBreacher (Kaspersky Endpoint Security), and PrettyPrague (Avast Antivirus) -- itself one release in a much larger, ongoing campaign of at least thirteen public zero-day PoCs since roughly early April 2026.

- **Published:** 2026-09-04T00:00:00Z
- **Last reviewed:** 2026-09-04T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2330
- **ID:** TL-2026-2330
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Chaotic Eclipse
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-69414

## Description

FalconFlank is a publicly released, MIT-licensed proof-of-concept exploit (github.com/MSNightmare/FalconFlank) that abuses CrowdStrike Falcon Sensor's 'Microsoft Office file malicious macro removal' remediation feature to locally escalate privileges to SYSTEM on fully updated Windows 11 25H2 and Windows Server 2025 hosts running Falcon with Phase 3 Optimal Protection. No CVE has been assigned and CrowdStrike has not confirmed the vulnerability as of publication, but the vendor acknowledged it is actively investigating the claims.

Mechanically, the flaw turns a defensive workflow against itself: Falcon's Office malicious-macro remediation process operates with elevated (SYSTEM-level) rights, and the PoC's author states the exploit works by manipulating the DLL the remediation workflow loads ('change the dll load technique'), consistent with a DLL-hijacking/side-loading technique that lets a low-privileged local process ride the elevated remediation process to code execution, ultimately spawning a SYSTEM-privileged Windows command prompt. Exploitation requires local code-execution capability or an existing local account on the target and depends on the 'Microsoft Office file malicious macro removal' policy being enabled. The researcher notes that by the time of public release CrowdStrike would likely already detect the unmodified PoC, so successful testing requires either adding Falcon exclusions or obfuscating/re-tooling the DLL-load stage -- an explicit acknowledgment that the technique is evadable but not neutralized by disclosure alone.

CrowdStrike's public response, delivered through a FalconFlank Tech Alert on its support portal, is to advise customers to disable the 'Microsoft Office File Suspicious Macro Removal' Windows policy setting while noting that customers remain protected through Falcon's separate Cloud Anti-malware for Microsoft Office Files setting. No patch or CVE had been issued as of the most recent coverage; independent validation of the PoC's reliability is still pending.

FalconFlank is not an isolated release. The same researcher, operating under the aliases Chaotic Eclipse, MSNightmare, Nightmare-Eclipse, and INFINITE NIGHTMARE, has run a rapid-fire campaign of local-privilege-escalation disclosures against major endpoint security vendors in the weeks prior: ShieldBreak (CVE-2026-69414, a Microsoft Malware Protection Engine flaw bypassing the earlier RoguePlanet patch, CVE-2026-50656, disclosed 2026-08-14), HardBreacher (a Kaspersky Endpoint Security for Windows 14.0.0.504 privilege-escalation PoC published 2026-08-29 that the researcher themselves described as 'duct-taped' together, and which the researcher states can also crash Kaspersky's UI process or arbitrarily grant/block file access), and PrettyPrague (a GenDigital Avast Antivirus sandbox-abuse PoC published 2026-09-01 that dumps the Windows SAM database for a SYSTEM shell, claimed to work on any Avast version and suspected to extend to AVG and Norton). SecurityWeek reporting indicates the researcher began this release cadence out of frustration with Microsoft's handling of prior vulnerability reports, and that at least some of the earlier PoCs from this same researcher have subsequently been observed exploited in the wild by unrelated malicious actors -- a material consideration for defenders even though FalconFlank itself has no confirmed active exploitation yet.

The FalconFlank/HardBreacher/PrettyPrague trio is itself only the latest wave of a much larger campaign: Nightmare Eclipse has publicly released at least thirteen zero-day proofs-of-concept since roughly early April 2026 -- BlueHammer (CVE-2026-33825), RedSun, UnDefend, GreenPlasma, RoguePlanet, YellowKey, GreatXML, LegacyHive, ShieldBreak, HardBreacher, PrettyPrague, GreenSection, and FalconFlank -- the large majority against Microsoft Windows/Defender components, with the most recent releases pivoting to third-party endpoint-security vendors (Kaspersky, Avast, CrowdStrike) and, with GreenSection, to NVIDIA GPU drivers outside the security-software space entirely. The Register and SecurityWeek both characterize the researcher as 'disgruntled,' openly running the disclosure spree as an adversarial campaign against Microsoft's vulnerability-handling and bug-bounty practices rather than for financial, ideological, or nation-state motives. RoguePlanet, the immediate predecessor in this lineage, itself weaponized a Time-of-Check-to-Time-of-Use (TOCTOU) race condition in Defender's SYSTEM-privileged quarantine pipeline -- staging an NTFS junction/symlink path redirection so a privileged writer follows the link to an attacker-controlled destination -- to spawn a SYSTEM command prompt; Microsoft assigned it CVE-2026-50656 and shipped a fix (Malware Protection Engine 1.1.26060.3008) on 2026-07-08, which ShieldBreak subsequently bypassed. This lineage matters for FalconFlank because it establishes the researcher's demonstrated, repeatable pattern: turn a security product's own SYSTEM-privileged remediation/quarantine workflow into a local privilege-escalation primitive, then repeat against the next vendor once a patch lands.

Because the PoC source is public and MIT-licensed, and because the underlying class of bug (a security product's own elevated remediation workflow being turned into a local privilege-escalation primitive) has now been demonstrated against three major endpoint security vendors in one month on top of a long-running string of Microsoft-focused disclosures, defenders running CrowdStrike Falcon should treat this as an actionable exposure regardless of CVE status.

## MITRE ATT&CK

- T1059.003 Windows Command Shell
- T1548 Abuse Elevation Control Mechanism
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1497 Virtualization/Sandbox Evasion
- T1078.003 Local Accounts
- T1003.002 Security Account Manager

## Sources

- [New CrowdStrike FalconFlank zero-day grants SYSTEM privileges](https://www.bleepingcomputer.com/news/security/new-crowdstrike-falconflank-zero-day-grants-system-privileges/)
- [Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon](https://thehackernews.com/2026/09/researcher-releases-falconflank-poc.html)
- [MSNightmare/FalconFlank](https://github.com/MSNightmare/FalconFlank)
- [Chaotic Eclipse Releases Crowdstrike Falcon ZeroDay FalconFlank](https://securityaffairs.com/198342/hacking/chaotic-eclipse-releases-crowdstrike-falcon-zeroday-falconflank.html)
- [FalconFlank exposes CrowdStrike Falcon privilege flaw](https://www.techzine.eu/news/security/144053/falconflank-exposes-crowdstrike-falcon-privilege-flaw/)
- [CrowdStrike Falcon Zero-Day Lets Attackers Escalate Privileges](https://gbhackers.com/crowdstrike-falcon-zero-day/)
- [Researcher Claims CrowdStrike Falcon 0-Day Privilege Escalation Vulnerability](https://cybersecuritynews.com/crowdstrike-falcon-0-day/)
- [Nightmare Eclipse Drops 'HardBreacher' Kaspersky Product Exploit](https://www.securityweek.com/nightmare-eclipse-drops-hardbreacher-kaspersky-product-exploit/)
- [Chaotic Eclipse Releases Kaspersky Zero-Day HardBreacher](https://securityaffairs.com/198214/hacking/chaotic-eclipse-releases-kaspersky-zero-day-hardbreacher.html)
- [Chaotic Eclipse Releases GenDigital Avast Antivirus ZeroDay PrettyPrague](https://securityaffairs.com/198243/hacking/chaotic-eclipse-releases-gendigital-avast-antivirus-zeroday-prettyprague.html)
- [Microsoft working on Defender patch for ShieldBreak zero-day](https://www.bleepingcomputer.com/news/security/microsoft-working-on-defender-patch-for-shieldbreak-zero-day/)
- [CVE-2026-69414 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-69414)
- [Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC](https://www.theregister.com/security/2026/09/03/prolific-microsoft-0-day-hunter-drops-crowdstrike-falcon-exploit-poc/5294318)
- [RoguePlanet: Anatomy of the Nightmare Eclipse Microsoft Defender Zero-Day](https://www.picussecurity.com/resource/blog/rogueplanet-anatomy-of-the-nightmare-eclipse-microsoft-defender-zero-day)
- [Nightmare Eclipse Drops 'LegacyHive' Windows Zero-Day](https://www.securityweek.com/nightmare-eclipse-drops-legacyhive-windows-zero-day/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2330