CrowdStrike Investigating FalconFlank PoC for Windows Privilege Escalation in Falcon Sensor

A public proof-of-concept called FalconFlank has put a spotlight on a privilege escalation weakness in CrowdStrike Falcon Sensor on Windows. The researcher known as Chaotic Eclipse published the code, saying it abuses the way the endpoint security product handles Microsoft Office malicious macro remediation. According to the researcher, the technique works on a fully updated Windows 11 25H2 machine or Windows Server 2025 with CrowdStrike Falcon installed. CrowdStrike told The Hacker News it is investigating the claims. The company is advising customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting while keeping the Cloud Anti-malware for Microsoft Office Files settings enabled, and it points users to a FalconFlank Tech Alert in the CrowdStrike support portal.

Privilege escalation is a type of flaw that lets a user or program with limited access gain higher permissions, such as administrator or SYSTEM rights. On a Windows computer, an attacker who can already run code locally could use this kind of bug to take fuller control of the machine, disable protections, or install persistent malware. The FalconFlank proof-of-concept focuses on the macro remediation path inside CrowdStrike Falcon Sensor. Office macros are small automated scripts in documents, and security products often inspect or neutralize suspicious macros. The researcher says the remediation logic can be abused to load attacker-controlled code. Chaotic Eclipse added that Falcon may already detect the proof-of-concept, so testing may require adding an exclusion or obfuscating the code and changing the DLL load technique.

CrowdStrike's guidance is specific. Disabling the Microsoft Office File Suspicious Macro Removal policy setting removes one component that the proof-of-concept appears to lean on, while the separate Cloud Anti-malware for Microsoft Office Files settings continue to provide protection. The company said it is actively investigating the report and has not described a patch timeline. For IT teams, this means reviewing endpoint configuration against the official Tech Alert and tracking the support portal for updates. The flaw matters to website owners and businesses because many companies run Falcon on laptops, desktops, and servers, and a local privilege escalation can help malware spread from one compromised account to an entire Windows fleet.

FalconFlank is only the latest in a series of proof-of-concept releases from the same researcher. Days earlier, Chaotic Eclipse released HardBreacher, a privilege escalation proof-of-concept for Kaspersky endpoint security for Windows version 14.0.0.504. The researcher described the proof-of-concept as rough, saying it is basically duct taped and may need repeated runs, but when it succeeds it creates a file named MY_SNAKE_IS_SOLID.dll in the Windows System32 folder with full permissions for the current user. Chaotic Eclipse said Kaspersky loses control when the user interface process is taken over, potentially causing the security product to stop functioning or grant or block access to files incorrectly. Kaspersky later told The Hacker News that it has resolved the HardBreacher issue and delivered the fix through an automatic update, with the option for users to trigger a database update manually.

Last month the researcher also published ShieldBreak, a Microsoft Defender zero-day tracked as CVE-2026-69414. ShieldBreak could allow arbitrary code execution with SYSTEM privileges, the highest built-in Windows account level. It is assessed as a patch bypass for CVE-2026-50656, also known as RoguePlanet, and Microsoft has not released a fix. Security company LevelBlue described ShieldBreak as combining Cloud Files, Object Manager namespace manipulation, direct Windows Defender API invocation, and a timing race in the remediation path. The result, according to LevelBlue, is a local privilege escalation chain in which Windows Defender's own clean engine is redirected to write an attacker-supplied DLL named phoneinfo.dll in the Windows System32 folder, after which SYSTEM execution follows through the built-in Windows Error Reporting task. This illustrates how endpoint defenses themselves can become a path for attackers when internal components are misused.

Chaotic Eclipse also shared frustration about Microsoft's response, saying the company continues to ghost them and refuses to communicate. In a post dated August 14, 2026, the researcher said restrictions by Microsoft make it difficult to report bugs to vendors, and that Microsoft does not check the case. The researcher added an intention to start publishing bugs for third parties in the window before Patch Tuesday, the monthly Microsoft security update release. These remarks are part of a pattern of public disclosure without a vendor fix. The specific vulnerabilities described here require an attacker to already have code running on the machine, so they are not remote code execution bugs by themselves, but they can turn a minor foothold into complete system control.

The update from The Hacker News added two more proof-of-concept releases from Chaotic Eclipse. GreenSection targets an NVIDIA memory corruption bug and causes any application that uses Vulkan or OpenGL to crash after the proof-of-concept is executed. PrettyPrague is a privilege escalation flaw in Gen Digital's Avast antivirus software. The researcher says PrettyPrague dumps the SAM database by abusing a vulnerability in Avast Sandbox and spawns a full SYSTEM shell. At the time of writing, the proof-of-concept works with fully patched Avast Antivirus on a patched Windows 11 25H2, and Chaotic Eclipse believes the flaw may also affect other Gen Digital products such as AVG and Norton. A Gen spokesperson said the company was recently made aware of the vulnerability, initiated security response procedures, and is actively developing a patch.

For organizations running Windows endpoints alongside web hosting and cloud services, a security-focused IT partner such as AEU-I can help ensure endpoint policies, exclusions, and updates are reviewed and kept consistent with vendor guidance like CrowdStrike's Tech Alert.