Vulnerabilities · 51 days ago
On September 3, CrowdStrike advised Falcon customers to disable a Windows policy setting after researcher Nightmare Eclipse published FalconFlank, a privilege-escalation proof of concept. The same disclosure wave included exploits targeting Avast and Nvidia. Gen Digital said it fixed an issue affecting a subset of its products, including Avast; CrowdStrike is still investigating its case.
FalconFlank abuses Falcon’s feature for removing suspicious Office macros: the security product’s cleanup action becomes the route to higher privileges. Disabling that feature blocks this exploit path, and CrowdStrike says cloud anti-malware for Office files remains active, but the specific macro-removal behavior is lost.
The disclosures follow Nightmare Eclipse’s Kaspersky exploit, extending the pattern across security vendors. For Falcon fleets that rely on macro removal, cloud scanning remains, but that cleanup path is absent while CrowdStrike investigates—leaving a gap in how suspicious macros are handled.
5 sources covering this story
Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits
The proof-of-concept (PoC) exploits lead to privilege escalation, spawning a shell with System privileges.
Researcher Shares CrowdStrike Privilege Escalation Zero Day
A security researcher has posted a zero-day exploit in CrowdStrike which could allow hackers to escalate privileges
New CrowdStrike 'FalconFlank' zero-day grants SYSTEM privileges
An anonymous security researcher who uses the
Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC
A shared security 'Nightmare'
Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon
FalconFlank abuses CrowdStrike Falcon's malicious macro remediation to demonstrate local privilege escalation on updated Windows systems.
Part of the PlainSec briefing for 2026-09-09