FalconFlank: PoC Released for Privilege Escalation in CrowdStrike Falcon

Macro remediation mechanism becomes an attack surface

A researcher known as Chaotic Eclipse, also active under the aliases INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse, recently published FalconFlank, a proof of concept for a potential local privilege escalation in CrowdStrike Falcon.

The disclosure was identified on September 3, 2026, but the exact publication date of the code is unknown.

The issue reportedly lies in the way the CrowdStrike Falcon Sensor handles remediation of malicious Office macros. These functions normally operate with elevated permissions, which are required to modify files, processes, and other protected system resources. FalconFlank reportedly attempts to divert this workflow and turn it into a primitive for privilege escalation.

The attack vector is local. This means the PoC does not, by itself, describe a method for remotely compromising a machine protected by Falcon. An attacker would need to be able to perform operations on the target system, but the required level of initial access is unknown.

The level of privilege that can be obtained has also not been specified. In particular, it has not been confirmed whether FalconFlank directly provides NT AUTHORITY\SYSTEM privileges, as the ShieldBreak PoC reportedly does against Microsoft Defender.

The release of the code nevertheless reduces the gap between security research and operational abuse. An attacker who has already gained access to an endpoint could attempt to incorporate the technique into a post-compromise chain.

Systems tested, but no specific vulnerable version identified

According to the researcher, FalconFlank can be run on a fully updated Windows 11 25H2 machine or on Windows Server 2025, provided that CrowdStrike Falcon is installed.

These details describe the test environments but do not precisely define the scope of the vulnerability. The following information has not been disclosed:

• the vulnerable CrowdStrike Falcon Sensor version number;
• the first affected release;
• any unaffected versions;
• a CVE identifier;
• a CVSS score;
• an official patch or workaround.

It is therefore not possible to determine whether the issue affects every Falcon installation on the two platforms, a specific configuration, or only certain sensor builds.

No hashes, filenames, commands, or paths directly associated with FalconFlank have been made available either. The description mentions modifying a DLL-loading technique but does not provide sufficient indicators to create a reliable detection rule based solely on this behavior.

In the absence of a CVE, FalconFlank cannot be linked to a specific entry in CISA’s Known Exploited Vulnerabilities catalog. No KEV listing date or remediation deadline is therefore known. Exploitation in real-world attacks has also not been documented.

Claims about CrowdStrike detections remain unconfirmed

Chaotic Eclipse believes that CrowdStrike may already have deployed detections capable of identifying the PoC. To bypass them during testing, the researcher suggests placing the sample in the product’s exclusions or obfuscating the code and modifying the DLL-loading method.

These are not defensive countermeasures. On the contrary, they reduce the product’s visibility and must not be applied indiscriminately to production systems.

The claim that Falcon already detects the sample has not been confirmed by CrowdStrike. It is also important to distinguish between detecting a publicly available copy of the PoC and detecting the underlying vulnerability: a signature based on hashes, strings, or code structure could fail when faced with a modified variant.

CrowdStrike was reportedly contacted for comment, but no response from the company appears to have been published. An official assessment, a list of affected releases, and information about the availability of a fix are therefore still lacking.

Until the vendor issues a statement, FalconFlank should be treated as a public PoC that has not yet been officially assessed, involving a potential local privilege escalation in a highly privileged endpoint component.

How to check for exposed endpoints

Organizations using CrowdStrike Falcon should first inventory Windows 11 25H2 and Windows Server 2025 systems on which the sensor is installed. They should also record the exact Falcon Sensor build so it can be quickly compared with any future advisory.

Log searches should focus on multiple correlated signals:

• anomalous events during Office macro remediation;
• unusual DLL loads occurring around a sensor action;
• unexpected processes interacting with files being remediated;
• the addition or modification of CrowdStrike exclusions;
• sensor shutdowns, errors, or anomalous behavior;
• repeated execution of samples that trigger remediation followed by library loads.

A single anomaly does not prove exploitation. However, correlating a macro-enabled document, product remediation activity, and an unexpected privileged operation provides a stronger starting point for investigation.

Any testing of the PoC should take place exclusively in an isolated, authorized laboratory equipped with appropriate telemetry. Adding the sample to corporate exclusions simply to “see whether it works” unnecessarily exposes endpoints and disables the very controls that should detect it.

The primary measure remains monitoring CrowdStrike communications. Once a fixed version or official instructions become available, administrators should verify both that the sensor has been updated and that the new build has actually been deployed to managed hosts.

HardBreacher and ShieldBreak: three endpoint products under scrutiny

FalconFlank was released just days after HardBreacher, another PoC by the same researcher, this time targeting Kaspersky Endpoint Security for Windows 14.0.0.504.

HardBreacher is described as unstable and may require several execution attempts before succeeding. When successful, it creates:

C:\Windows\System32\MY_SNAKE_IS_SOLID.dll

The file reportedly receives full permissions for the current user. Kaspersky’s interface process protection may also terminate the product, alter file-access decisions, and cause operating system instability. These are indicators of HardBreacher, not FalconFlank.

In the month before FalconFlank was published, the researcher also released ShieldBreak, associated with CVE-2026-69414 and targeting the Microsoft Malware Protection Engine used by Defender. The vulnerability has a CVSS 7.8 score and reportedly allows code execution with NT AUTHORITY\SYSTEM privileges.

The chain attributed to ShieldBreak combines Cloud Files functionality, Object Manager namespace manipulation, direct calls to Defender APIs, and a race condition during remediation. The cleanup engine is reportedly coerced into writing an attacker-controlled DLL to:

C:\Windows\System32\phoneinfo.dll

Privileged execution would then occur through a built-in Windows Error Reporting task. This path is not an indicator of FalconFlank either.

ShieldBreak is presented as a potential bypass of the fix for CVE-2026-50656, known as RoguePlanet. Both Microsoft vulnerabilities use the following vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

They therefore require local access and low privileges, but no user interaction; the potential impact is high across confidentiality, integrity, and availability.

For CVE-2026-50656 and CVE-2026-69414, their status, listing date, and remediation deadline in the CISA KEV catalog are unknown. Microsoft is reportedly working on a security update for ShieldBreak, but no release date has been provided.

Disclosure remains contentious and incomplete

The case is part of a series of disclosures focused on the privileged mechanisms of Windows security products. For Microsoft, the following vulnerabilities have also been added to the KEV catalog in the past 90 days: CVE-2019-1068 on August 26, 2026, CVE-2026-55040 and CVE-2026-33824 on August 18, 2026, CVE-2026-68820 on August 11, 2026, CVE-2026-50522 on July 22, 2026, and CVE-2026-58644 on July 16, 2026.

In a post dated August 14, 2026, Chaotic Eclipse accused Microsoft of obstructing the handling of the researcher’s reports and portraying them as an unstable criminal. The researcher also stated an intention to publish vulnerabilities in third-party products before Patch Tuesday. Microsoft has not confirmed these claims.

For FalconFlank, the key operational fact remains the vendor’s lack of a public position. The PoC exists, targets a remediation activity performed by a highly privileged product, and was reportedly tested on fully updated Windows systems. However, the information needed to accurately assess exposure, reliability, and impact is still missing.

Administrators should neither ignore the publicly available code nor treat it as evidence of a confirmed widespread compromise. For now, the most effective response is to strengthen monitoring, protect sensor exclusions, and be ready to rapidly implement CrowdStrike’s official guidance.