Chaotic Eclipse disclosed FalconFlank, a claimed zero-day privilege escalation vulnerability in CrowdStrike Falcon that allegedly abuses Microsoft Office malicious macro remediation in the Falcon Sensor. CrowdStrike is actively investigating the claims and advises customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting. According to the company, customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. The researcher also recently published PoCs for HardBreacher in Kaspersky Endpoint Security and ShieldBreak in Microsoft Defender, both targeting Windows security products and potentially leading to SYSTEM-level impact. #FalconFlank #CrowdStrikeFalcon #HardBreacher #KasperskyEndpointSecurity #ShieldBreak #MicrosoftDefender
Keypoints
- Chaotic Eclipse disclosed FalconFlank, a claimed zero-day privilege escalation vulnerability affecting CrowdStrike Falcon Sensor.
- The PoC allegedly abuses the Microsoft Office malicious macro remediation functionality.
- CrowdStrike is actively investigating the researcher’s claims.
- CrowdStrike advises customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting.
- The company says customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings.
- CrowdStrike customers can consult the FalconFlank Tech Alert in the company’s support portal.
- The researcher claims the PoC works on fully updated Windows 11 25H2 and Windows Server 2025 systems running CrowdStrike Falcon.
- Chaotic Eclipse also released HardBreacher, a privilege escalation PoC targeting Kaspersky Endpoint Security for Windows.
- The researcher previously published ShieldBreak, a claimed Microsoft Defender zero-day associated with SYSTEM-level code execution.
Read More: https://thehackernews.com/2026/09/researcher-releases-falconflank-poc.html