Researcher Publishes FalconFlank, a CrowdStrike Falcon Zero-Day That Grants SYSTEM Access

A security tool that is trusted to guard the rest of the operating system is only as safe as its own weakest function, and a researcher publishing under the handle Nightmare Eclipse has just demonstrated that principle in public. On Sep 3 the researcher released FalconFlank, a working zero-day exploit that escalates a low-privileged local user to SYSTEM on Windows systems running CrowdStrike Falcon, even when those systems carry every current update. It arrived as working code, with no advance notice to the vendor and no CVE identifier as of Sep 4.

Nightmare Eclipse stated that FalconFlank works on a fully updated Windows 11 25H2 installation and on Windows Server 2025, both running CrowdStrike Falcon with the Phase 3 Optimal Protection profile enabled. The researcher also warned that CrowdStrike may already have detections for the specific published sample, which means anyone who wants to reproduce the test would need to add exclusions or obfuscate the proof of concept and change the DLL load technique.

FalconFlank is not an isolated experiment. The same week, the researcher published HardBreacher, a privilege escalation exploit aimed at Kaspersky Endpoint Security, and PrettyPrague, a zero-day that abuses the Avast sandbox to dump the Windows SAM database and open a SYSTEM shell, plus GreenSection, a denial-of-service bug against Nvidia that the researcher says will crash the system. The CrowdStrike release is the third privilege escalation zero-day and the fourth total exploit disclosure from one researcher inside a single week.

Key Facts

The vulnerability lives in a CrowdStrike Falcon feature called Office malicious macros remediation. Falcon inspects Microsoft Office documents, and when it finds suspicious macros it strips the suspect code and writes the cleaned file back to its original location, an operation that runs with elevated rights because the sensor itself operates at high integrity on the host. Security Affairs reported on Sep 3 that the researcher describes the function as part of Falcon's remediation capabilities, operating with high privileges and open to abuse that elevates a low-privileged local user into a more powerful context. The researcher also uses the aliases Chaotic Eclipse, INFINITE NIGHTMARE, and MSNightmare, according to the same report.

Independent technical reviews describe a multi-stage chain. FalconFlank uses a decoy Office document, plants a file that targets bcrypt.dll inside the WindowsPowerShell directory under System32, creates a working directory beneath the temporary folder, and relies on opportunistic locks and mount point reparse points to redirect Falcon's privileged cleanup write. It then uses a Kernel Transaction Manager transaction to place the malicious DLL in the protected System32 location and triggers the built-in Application Experience scheduled task named MareBackup to execute it.

BleepingComputer reported on Sep 4 that successful exploitation lets an attacker spawn a command prompt with SYSTEM privileges by abusing the Office malicious macros remediation feature, and that the vulnerability had yet to be assigned a CVE ID. The affected configurations are specific rather than universal: fully updated Windows 11 25H2 and Windows Server 2025, CrowdStrike Falcon with the Phase 3 Optimal Protection profile, and the Microsoft Office file malicious macro removal capability enabled. No affected sensor version range was published, and there is no evidence that Falcon sensors on macOS or Linux are exposed.

CrowdStrike responded within a day. CrowdStrike said on Sep 4 that it was actively investigating the researcher's claims and advised customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting, while adding that customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. The company pointed customers to a FalconFlank Tech Alert in its support portal, a document that is not public and requires an account to view.

Analysis

FalconFlank matters because it attacks remediation machinery rather than the prevention engine that marketing emphasizes. Security products advertise their detection layers, but this exploit goes after the part of the sensor that cleans up after an infection, the component that must hold elevated rights so it can rewrite files an attacker may have touched. That is the same architectural tension that surfaced in July 2024, when a flawed Falcon update forced a global wave of Windows restarts across airlines, banks, and hospitals. The product's power is also its exposure.

Kevin Beaumont said on X on Sep 4 that the privilege escalation exploits Nightmare Eclipse released that week are real and work, an independent confirmation that moved the disclosure from a vendor dispute into a verified capability. Beaumont has tracked several of the researcher's proof-of-concept releases in the past week, including bugs in other endpoint products, and he told The Register that it makes sense the researcher would branch out because there are quality problems across the endpoint security space. He said he hopes the episode causes cybersecurity vendors to improve their own products rather than hype hypothetical AI attacks.

The bigger picture here is that one researcher has now produced working privilege escalation code against CrowdStrike, Kaspersky, and Avast in a week, plus a crash bug aimed at Nvidia, after spending months publishing zero-days against Microsoft. BleepingComputer reported on Sep 4 that the researcher has disclosed multiple zero-day exploits targeting Microsoft products since April, including Microsoft Defender and BitLocker, with named flaws that include LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend. Of those, five have since been fixed, while the rest remain zero-days awaiting an official patch.

What this really means is that an organization can do everything right, install every operating system update, enable the strongest protection profile, and still lose the endpoint to an attacker who is already on the box, because the trusted security agent itself performed the privileged file operation. FalconFlank is a local privilege escalation, so it requires an initial foothold, but modern intrusion chains frequently begin with a single unprivileged process. A dependable SYSTEM escalation is exactly the building block that ransomware operators and espionage groups collect, which is why a public working exploit for a product as widely deployed as Falcon carries outsized risk.

Why It Matters

The disclosure also reignites the responsible disclosure debate. The researcher published working code without a coordinated patch cycle and without a CVE, and CrowdStrike had no fix ready when the code went public on Sep 3. As of Sep 4, no CVE had been assigned and no patch had shipped, which left defenders to respond by changing a configuration setting while the exploit code remained public. Microsoft previously warned it would pursue legal action against people engaging in malicious activity that causes real harm to customers, a statement widely read as aimed at this researcher, yet the releases have continued.

For defenders, the practical risk is asymmetric. FalconFlank affects fully updated builds, so the standard advice to install patches does not help, and the vulnerable macro removal feature is a Windows policy that many administrators may have enabled as part of an optimal protection baseline. CrowdStrike Falcon is a dominant enterprise endpoint platform, so the pool of potentially affected hosts is large even though the exploit is a second-stage tool requiring local code execution rather than a remote compromise.

The exposure also has limits. Because the attacker must already have a foothold, the blast radius starts at a single host, and CrowdStrike may already detect the published sample, forcing any attacker to modify the technique. The researcher's own notes describe the chain as timing-sensitive, with a release build reportedly failing in the author's testing while a debug build succeeded. That fragility narrows the real-world window, but it does not close it.

Next Up

The immediate question is what CrowdStrike ships next. The company said on Sep 4 that it is investigating and that customers can disable the File Suspicious Macro Removal policy while staying protected through cloud anti-malware settings, a stopgap rather than a root-cause fix. Security teams should expect a CVE assignment and a sensor update in the coming days, and they should watch the CrowdStrike support portal for the non-public Tech Alert and follow-up guidance.

Organizations running Falcon on Windows 11 25H2 or Windows Server 2025 should treat the policy change as a measured trade-off rather than a reflex. Disabling macro removal weakens one layer of Office document defense, so administrators should confirm that compensating controls such as cloud anti-malware scanning, attachment filtering, and macro restrictions in Group Policy are active before they flip the setting. Hunt teams can also look for indicators tied to the published technique, including the FalconFlank named pipe and the temporary directory pattern the exploit creates.

The longer-term question is whether the endpoint security industry changes how it builds privileged components. FalconFlank, HardBreacher, and PrettyPrague all point at the same lesson: a security agent that must run at SYSTEM to protect a machine is itself a high-value target, and every privileged feature it adds, including macro cleanup and sandboxing, enlarges the attack surface. Until vendors treat their own remediation and analysis features as untrusted input, researchers with a grudge and a debugger will keep finding the next FalconFlank, and the defenders who trusted the tool will be left to respond.