FalconFlank Zero-Day Reportedly Enables SYSTEM Privileges on Updated Windows Systems
Summary
Researcher Nightmare Eclipse says FalconFlank abuses CrowdStrike Falcon’s Office malicious macros remediation feature to gain SYSTEM privileges on updated Windows 11 and Windows Server systems. CrowdStrike is investigating and advises disabling the feature’s policy.
Key points
- Nightmare Eclipse disclosed FalconFlank, an exploit targeting CrowdStrike Falcon’s Office malicious macros remediation feature.
- The researcher says successful exploitation can spawn a command prompt with SYSTEM privileges on fully updated Windows 11 25H2 and Windows Server 2025 systems.
- CrowdStrike says it is investigating the claims and advises customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting.
- CrowdStrike says customers remain protected through its Cloud Anti-malware for Microsoft Office Files settings; its FalconFlank alert is available only through its support portal.
- No CVE ID had been assigned at the time of the article. Security expert Kevin Beaumont confirmed that the privilege-escalation exploits Nightmare Eclipse released that week are real and work.
Article Details
- Vulnerability Types
- Privilege escalation
- Affected Versions
- Windows 11 25H2
- Windows Server 2025
- Exploitation Status
- reported
- Exploit Availability
- public_exploit
- Patch Status
- unknown
- Workarounds
- Disable the Microsoft Office File Suspicious Macro Removal Windows policy setting.
MITRE ATT&CK
People
Vendors
Products
CrowdStrike FalconAn anonymous researcher using the Nightmare Eclipse handle released FalconFlank, a CrowdStrike Falcon zero-day that can escalate privileges to SYSTEM on fully updated Windows 11 and Windows Server systems.CrowdStrike Falcon Sensoris a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon Sensor, obviously by the time I drop this Crowdstrike would already have detections for it so if youWindows 11An anonymous researcher using the Nightmare Eclipse handle released FalconFlank, a CrowdStrike Falcon zero-day that can escalate privileges to SYSTEM on fully updated Windows 11 and Windows Server systems.Windows ServerAn anonymous researcher using the Nightmare Eclipse handle released FalconFlank, a CrowdStrike Falcon zero-day that can escalate privileges to SYSTEM on fully updated Windows 11 and Windows Server systems.