cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Researcher Claims FalconFlank PoC Exploits CrowdStrike Falcon for Privilege Escalation

· Original article ↗

Summary

Chaotic Eclipse claims FalconFlank exploits Office macro remediation in CrowdStrike Falcon Sensor for privilege escalation. CrowdStrike is investigating and advises disabling a related Windows policy setting, while saying another configuration protects customers.

Key points

  • Chaotic Eclipse says FalconFlank is a zero-day privilege-escalation vulnerability in CrowdStrike Falcon Sensor that abuses Microsoft Office malicious-macro remediation.
  • The researcher claims the PoC works on fully updated Windows 11 25H2 and Windows Server 2025 systems running Falcon.
  • CrowdStrike is investigating the claims; the article reports no confirmed exploitation or independent validation.
  • CrowdStrike advises disabling the Microsoft Office File Suspicious Macro Removal Windows policy setting and says Cloud Anti-malware for Microsoft Office Files settings continue to protect customers.
  • The article also mentions HardBreacher, a researcher-released privilege-escalation PoC for Kaspersky Endpoint Security for Windows, and ShieldBreak, a claimed Microsoft Defender zero-day.

Article Details

Vulnerability Types
  • Local privilege escalation
Severity
Claimed zero-day; no severity rating reported.
Affected Versions
  • CrowdStrike Falcon Sensor on Windows 11 25H2 and Windows Server 2025 (researcher-claimed)
  • Kaspersky Endpoint Security for Windows 14.0.0.504
  • Microsoft Defender (version not specified)
Exploitation Status
reported
Exploit Availability
public_poc
Patch Status
partial
Workarounds
  • CrowdStrike advises disabling the Microsoft Office File Suspicious Macro Removal Windows policy setting; the company says customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings.

MITRE ATT&CK

T1055 · Process InjectionThe ShieldBreak description says an attacker-supplied DLL is written to System32 and then executed with SYSTEM privileges; it does not specify process injection.T1068 · Exploitation for Privilege EscalationFalconFlank, HardBreacher, and ShieldBreak are described as privilege-escalation PoCs targeting Windows security products.

CVE

CVE-2026-50656It’s assessed to be a patch bypass for CVE-2026-50656 (aka RoguePlanet).CVE-2026-69414Last month, the researcher also published a PoC for a Microsoft Defender zero-day called ShieldBreak (aka CVE-2026-69414) that could grant an attacker the ability to run arbitrary code with NT AUTHORITYSYSTEM privileges.

People

Chaotic EclipseSecurity researcher who released the FalconFlank, HardBreacher, and ShieldBreak PoCs.MSNightmareAlias explicitly identified for Chaotic Eclipse.Nightmare EclipseAlias explicitly identified for Chaotic Eclipse.Nightmare-EclipseAlias explicitly identified for Chaotic Eclipse.

Vendors

CrowdStrikeChaotic Eclipse disclosed FalconFlank, a claimed zero-day privilege escalation vulnerability in CrowdStrike Falcon that allegedly abuses Microsoft Office malicious macro remediation in the Falcon Sensor.KasperskyThe researcher also recently published PoCs for HardBreacher in Kaspersky Endpoint Security and ShieldBreak in Microsoft Defender, both targeting Windows security products and potentially leading to SYSTEM-level impact.MicrosoftChaotic Eclipse disclosed FalconFlank, a claimed zero-day privilege escalation vulnerability in CrowdStrike Falcon that allegedly abuses Microsoft Office malicious macro remediation in the Falcon Sensor.

Products

CrowdStrike FalconChaotic Eclipse disclosed FalconFlank, a claimed zero-day privilege escalation vulnerability in CrowdStrike Falcon that allegedly abuses Microsoft Office malicious macro remediation in the Falcon Sensor.CrowdStrike Falcon SensorChaotic Eclipse disclosed FalconFlank, a claimed zero-day privilege escalation vulnerability affecting CrowdStrike Falcon Sensor.Kaspersky Endpoint SecurityThe researcher also recently published PoCs for HardBreacher in Kaspersky Endpoint Security and ShieldBreak in Microsoft Defender, both targeting Windows security products and potentially leading to SYSTEM-level impact.Microsoft Defender Antimalware PlatformThe researcher also recently published PoCs for HardBreacher in Kaspersky Endpoint Security and ShieldBreak in Microsoft Defender, both targeting Windows security products and potentially leading to SYSTEM-level impact.Microsoft WindowsCrowdStrike is actively investigating the claims and advises customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting.

Tools

FalconFlankChaotic Eclipse disclosed FalconFlank, a claimed zero-day privilege escalation vulnerability in CrowdStrike Falcon that allegedly abuses Microsoft Office malicious macro remediation in the Falcon Sensor.HardBreacherThe researcher also recently published PoCs for HardBreacher in Kaspersky Endpoint Security and ShieldBreak in Microsoft Defender, both targeting Windows security products and potentially leading to SYSTEM-level impact.ShieldBreakThe researcher also recently published PoCs for HardBreacher in Kaspersky Endpoint Security and ShieldBreak in Microsoft Defender, both targeting Windows security products and potentially leading to SYSTEM-level impact.

Related Articles