A security researcher known as Chaotic Eclipse (also operating as INFINITE NIGHTMARE and MSNightmare) has publicly released FalconFlank, a zero-day proof-of-concept exploit that achieves local privilege escalation on systems running CrowdStrike Falcon. The PoC works against fully updated Windows 11 25H2 and Windows Server 2025 machines with Falcon installed. According to the researcher’s GitHub documentation, the attack abuses Falcon’s Office malicious macros remediation workflow — a feature designed to detect and remove macro-based threats — and redirects it into granting the current user elevated permissions they should not have.
CrowdStrike confirmed to The Hacker News that it is investigating the report and has issued interim guidance: customers should disable the “Microsoft Office File Suspicious Macro Removal Windows policy” setting in their Falcon configuration. The company adds that users remain protected through Falcon’s Cloud Anti-malware for Microsoft Office Files setting. CrowdStrike has also published a FalconFlank Tech Alert in its customer support portal. The same researcher recently released HardBreacher, a privilege escalation PoC targeting Kaspersky Endpoint Security for Windows (version 14.0.0.504), which Kaspersky says it has already patched via an automatic update. Earlier, the researcher published ShieldBreak (CVE-2026-69414), a local privilege escalation against Microsoft Defender that Microsoft has not yet patched.
How to check if you’re affected
Affected products include Windows 11 25H2 and Windows Server 2025 systems with CrowdStrike Falcon Sensor installed. If your organization uses Falcon, check the CrowdStrike support portal for the FalconFlank Tech Alert. As an interim mitigation, disable the “Microsoft Office File Suspicious Macro Removal Windows policy” setting in your Falcon policy configuration. Cloud Anti-malware protection for Office files remains effective and should stay enabled.