CrowdStrike Falcon Sensor Local Privilege Escalation Zero

Threat Summary On September 3, 2026, a security researcher known as Nightmare Eclipse/Chaotic Eclipse publicly disclosed a zero-day dubbed ‘FalconFlank’ which abuses the Office malicious macro remediation workflow in CrowdStrike Falcon Sensor. The attack leverages a time-of-check to time-of-use (TOCTOU) race condition, allowing an attacker with code execution on a vulnerable system to hijack the Falcon macro remediation routine. This results in DLL side-loading and execution as NT AUTHORITY\SYSTEM. The exploit is effective against fully-updated versions of Windows 11 (25H2) and Server 2025, provided CrowdStrike Falcon is running in Phase 3 Optimal Protection with the macro removal policy enabled. The PoC is publicly available on GitHub and can be leveraged by moderately skilled threat actors with development capability to achieve SYSTEM-level privileges. At the time of writing, no attacks have been reported. CrowdStrike has not yet issued a public advisory or patch but recommends (via internal tech alert) that customers disable the affected macro remediation policy as an interim workaround. Detection is challenging. Hash-based antivirus signatures are easily bypassed, and only behavior-based monitoring, such as unusual SYSTEM processes spawned by csfalconservice.exe, abnormal DLL loads, or the presence of FalconFlank.exe can highlight malicious activity. Recommendations Immediate Actions: - Disable the ‘Microsoft Office file Suspicious Macro Removal’ policy via the CrowdStrike Falcon console (Phase 3 policy setting). This is the only vendor-approved workaround and removes the attack vector for FalconFlank. Confirm policy propagation to all endpoints. - Disclosure from CrowdStrike: “Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings.” Short-Term Defensive Measures: - Enforce Group Policy or endpoint controls to block macros from the Internet and disable all macros with notification in Microsoft Office (as a compensating control). - Restrict the creation of NTFS symbolic links by non-privileged users where possible. Long-Term/Strategic: - Engage with CrowdStrike support to request direct advisory updates and private notifications about patch timelines and remediation steps. - Retain enhanced endpoint monitoring and centralize event logs (Sysmon, SIEM, EDR detection) to catch adaptation of the attack or follow-on tools. - Educate users on risks of macro-enabled Office documents; maintain regular security awareness campaigns focused on social engineering and macro attacks. - Monitor for new advisories, patches, or CVEs from CrowdStrike and downstream OS security advisories, acting as soon as fixes are published. Temporary Workarounds - Officially documented workaround: Disable the ‘Microsoft Office file Suspicious Macro Removal’ policy from the Falcon console for all vulnerable Windows endpoints. This removes the primary FalconFlank exploit vector while retaining other protective capabilities. - Enforce Office macro-restriction policies: Use Group Policy to block macros from the internet, set VBAWarnings to 4 (disable all macros with notification), restrict trusted locations and startup paths in Office. References: - https://www.bleepingcomputer.com/news/security/new-crowdstrike-falconflank-zero-day-grants-system-privileges/ - https://thehgtech.com/articles/falconflank-crowdstrike-falcon-lpe-analysis.html - https://github.com/MSNightmare/FalconFlank - https://intelfusions.com/news/falconflank-falcon-macro-remediation-lpe - https://socradar.io/blog/falconflank-crowdstrike-falcon-0day-poc