As reported by BleepingComputer, an anonymous researcher operating under the handle "Nightmare Eclipse" has published a working proof-of-concept exploit dubbed "FalconFlank," targeting CrowdStrike Falcon's Microsoft Office macro remediation feature to achieve SYSTEM-level privilege escalation on fully updated Windows 11 25H2 and Windows Server 2025 environments. CrowdStrike has confirmed it is investigating and recommends disabling the Microsoft Office File Suspicious Macro Removal Windows policy setting as an interim mitigation.

Security Impact: Nightmare Eclipse has, in the same week, dropped public zero-day PoCs for CrowdStrike Falcon, Kaspersky Antivirus for Endpoint ("HardBreacher"), GenDigital Avast ("PrettyPrague"), and Nvidia ("GreenSection").

Vulnerability Overview

FieldDetail
Name / AliasFalconFlank
CVE IDNot yet assigned
SeverityHigh (local privilege escalation to SYSTEM)
Affected ProductsCrowdStrike Falcon Sensor on Windows 11 25H2, Windows Server 2025 (likely broader Windows versions)
Exploitation VectorAbuse of Falcon's Office malicious macros remediation feature to spawn SYSTEM-privileged process
Patch AvailableNot yet — vendor advisory is non-public (support portal only)
Active ExploitationNo confirmed in-the-wild attacks; PoC is public
Vendor AdvisoryAvailable to CrowdStrike support portal customers ("FalconFlank Tech Alert")

Why This Matters

The most significant takeaway is not any single bug — it is the pattern. Nightmare Eclipse has, in the same week, dropped public zero-day PoCs for CrowdStrike Falcon, Kaspersky Antivirus for Endpoint ("HardBreacher"), GenDigital Avast ("PrettyPrague"), and Nvidia ("GreenSection"). Independent researcher Kevin Beaumont has confirmed the privilege escalation exploits are functional. This is a deliberate, coordinated campaign demonstrating that endpoint security agents — the very tools defenders rely on — are themselves a rich and underappreciated attack surface.

Security products run at the highest privilege levels by design. They parse untrusted file formats, inject into processes, and load drivers and DLLs. Each of those behaviors is a potential privilege escalation primitive. When a researcher can abuse a macro-remediation feature to spawn a SYSTEM shell, the irony writes itself: the control meant to neutralize malicious macros becomes the delivery mechanism for full system compromise.

EDR agents are not just security tools — they are high-privilege, always-on, file-parsing daemons that run on every endpoint. Treat them as critical infrastructure, not as set-and-forget utilities.

Who Is Most at Risk

  • Organizations with Falcon's File Suspicious Macro Removal policy enabled — this is the specific feature being abused.
  • Environments where non-admin users can execute arbitrary code — the exploit is local privilege escalation, so an attacker needs an initial foothold (phishing, drive-by, insider) before leveraging it.
  • High-value targets — financial services, government, healthcare, and critical infrastructure where SYSTEM-level access enables lateral movement, credential dumping, and persistence.
  • Organizations slow to apply sensor updates — once CrowdStrike ships a fix, the window between disclosure and deployment becomes the critical metric.

Shield53 Recommendations

Immediate Actions (Within 24 Hours)

Shield53 Recommendations
Disable the Microsoft Office File Suspicious Macro Removal policy setting in Falcon as CrowdStrike advises. Confirm that Cloud Anti-malware for Microsoft Office Files remains enabled so detection coverage is not reduced.
Access the FalconFlank Tech Alert in the CrowdStrike support portal for vendor-specific guidance. If you lack portal access, open a support case immediately and request the advisory.
Hunt for indicators of exploitation — look for unexpected child processes spawned by Falcon Sensor processes (e.g., cmd.exe, powershell.exe spawned by CSFalconService.exe or related binaries). Legitimate Falcon operations do not spawn interactive command shells.
Restrict interactive logon privileges on high-value systems to reduce the pool of accounts capable of local exploitation.

Short-Term Hardening (1–2 Weeks)

  • Inventory all endpoint security agents across your estate — not just CrowdStrike. Nightmare Eclipse's simultaneous disclosures targeting Kaspersky and Avast suggest a broad methodology. Confirm all vendors have been contacted for guidance.
  • Apply sensor updates promptly when CrowdStrike releases a patched Falcon Sensor version. Track the update like any other critical patch — do not let EDR sensor updates fall into a quarterly maintenance window.
  • Enable tamper protection on Falcon and verify it is functioning. While this does not directly prevent the LPE, it raises the bar for post-exploitation tampering.
  • Monitor for DLL sideloading and unsigned module loads in the Falcon Sensor process context. Many EDR privilege escalation techniques abuse DLL load order or unsigned module paths.

Strategic Posture

  • Pressure security vendors for transparency. CrowdStrike's decision to place the advisory behind a support portal login is understandable for customer communication but limits community defensive visibility. Push vendors toward coordinated disclosure with public technical details once mitigations are available.
  • Assume your EDR is a target. Build detection content for anomalous behavior originating from security agent processes. If your SIEM cannot distinguish "Falcon doing legitimate work" from "Falcon being abused," you have a blind spot by definition.
  • Diversify detection layers. No single agent should be your only detection mechanism. Layer EDR with Sysmon, Windows Event Forwarding, and network detection so that compromise of one agent does not collapse your visibility.

The FalconFlank disclosure is a reminder that the security stack is itself part of the attack surface. The tools we trust to protect endpoints can be turned against us. Defenders must hold security vendors to the same patching, transparency, and hardening standards they demand of every other software vendor in their environment.