Affected Systems

CrowdStrike Falcon Sensor on fully updated Windows 11 25H2 and Windows Server 2025. The vulnerability exploits the Office malicious macros remediation feature. No CVE assigned yet. All versions with the macro remediation feature enabled appear affected.

Exploitation Status

Public PoC released by researcher Chaotic Eclipse on GitHub. CrowdStrike states they may already have detections deployed. Active exploitation in the wild is unknown but PoC availability significantly lowers the barrier.

Business Impact

Attackers with local access can escalate to higher privileges on endpoints protected by CrowdStrike Falcon, potentially bypassing EDR protections. This undermines the security posture of systems relying on Falcon for endpoint defense. Organizations using Falcon on Windows 11 or Server 2025 with Office macro remediation enabled face immediate risk. No CVSS score published yet.

Urgency

🔴 Immediate

Recommended Actions

  • Disable the 'Microsoft Office File Suspicious Macro Removal Windows' policy setting immediately on all systems running CrowdStrike Falcon per vendor guidance
  • Verify that 'Cloud Anti-malware for Microsoft Office Files' settings remain enabled to maintain protection against Office-based threats
  • Review the FalconFlank Tech Alert in the CrowdStrike support portal for additional technical details and detection guidance
  • Monitor CrowdStrike Falcon logs for unusual privilege escalation attempts or anomalous Office macro remediation activity
  • Apply vendor patches or configuration updates as soon as CrowdStrike releases a permanent fix for this zero-day

---

# Threat Actor Context

Actor Profile

Chaotic Eclipse (also known as INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) is a security researcher who has recently gained attention for publicly releasing proof-of-concept exploits for zero-day vulnerabilities in major endpoint security products. The researcher's motivation appears to stem from frustration with vendor response processes, particularly Microsoft's alleged lack of engagement and communication restrictions. Chaotic Eclipse has stated they are publishing vulnerabilities for third-party products during windows when Microsoft Patch Tuesday has not yet been released, expressing a desire to "live like a normal human being." The researcher's activities represent a controversial approach to vulnerability disclosure, bypassing traditional coordinated disclosure processes.

TTPs (Tactics, Techniques, Procedures)

FalconFlank exploits the office malicious macros remediation feature in CrowdStrike Falcon Sensor to achieve privilege escalation (T1068 - Exploitation for Privilege Escalation). The attack targets fully updated Windows 11 25H2 and Windows Server 2025 systems running CrowdStrike Falcon. The researcher notes that obfuscation techniques and alternative DLL loading methods (T1055 - Process Injection) may be required to evade detections CrowdStrike may have implemented. The vulnerability allows attackers to escalate privileges on affected systems, potentially achieving elevated access to protected resources. The researcher's pattern includes releasing self-contained local privilege escalation chains that abuse legitimate security product functionality.

Targets & Patterns

The FalconFlank vulnerability targets organizations using CrowdStrike Falcon Sensor for endpoint protection, particularly those running Windows 11 25H2 or Windows Server 2025. Given CrowdStrike's widespread deployment across enterprise environments, critical infrastructure, and high-value targets, the potential victim pool is significant. The vulnerability is particularly concerning because it weaponizes a security product's own remediation features against itself. Organizations in sectors that rely heavily on CrowdStrike for endpoint detection and response—including financial services, government, healthcare, and technology—face elevated risk. The public release of a working PoC significantly lowers the barrier to exploitation for threat actors of varying sophistication levels.

Historical Context

FalconFlank represents the latest in a series of endpoint security product zero-days released by Chaotic Eclipse in August-September 2026. Days before FalconFlank, the researcher released HardBreacher, a privilege escalation flaw in Kaspersky endpoint security (version 14.0.0.504), which Kaspersky subsequently patched via automatic update. In the preceding month, Chaotic Eclipse published ShieldBreak (CVE-2026-69414), a Microsoft Defender zero-day enabling arbitrary code execution with SYSTEM privileges, assessed as a patch bypass for CVE-2026-50656 (RoguePlanet). ShieldBreak combined Cloud Files API abuse, Object Manager namespace manipulation, and Windows Defender API invocation. The researcher has publicly stated that Microsoft has refused communication and imposed restrictions preventing them from reporting bugs to other vendors, leading to their decision to publish zero-days publicly during windows between Patch Tuesday releases.

Defensive Recommendations

  • Immediately disable the Microsoft Office File Suspicious Macro Removal Windows policy setting in CrowdStrike Falcon as advised by CrowdStrike, and rely on Cloud Anti-malware for Microsoft Office Files settings instead
  • Monitor for unusual DLL loading activity and process injection attempts (T1055) on systems running CrowdStrike Falcon, particularly targeting Falcon Sensor processes
  • Review CrowdStrike support portal for the FalconFlank Tech Alert and apply any available patches or configuration changes as soon as they are released
  • Implement application whitelisting and restrict DLL loading to trusted paths to mitigate privilege escalation attempts (T1068) that abuse security product remediation features
  • Enable enhanced logging for privilege escalation attempts, focusing on suspicious file creation in system directories (e.g., C:\Windows\System32) and monitor for anomalous access to security product processes