New CrowdStrike 'FalconFlank' zero-day grants SYSTEM privileges
CrowdStrike Falcon zero-day 'FalconFlank' allows SYSTEM privilege escalation on Windows.
A security researcher known as 'Nightmare Eclipse' has released a zero-day exploit named 'FalconFlank' that grants SYSTEM privileges on up-to-date Windows 11 and Windows Server systems running CrowdStrike Falcon. The exploit abuses a feature designed to remediate malicious Office macros. CrowdStrike is investigating and advises customers to disable a specific Windows policy setting.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CrowdStrike?
Get an email when a new story names CrowdStrike, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe 'FalconFlank' zero-day exposes a critical privilege escalation flaw in CrowdStrike Falcon, a tool organizations rely on for endpoint protection — demonstrating that even security software itself can become an attack surface. The exploit abuses a legitimate remediation feature designed to handle malicious Office macros, highlighting how trusted functionality can be weaponized when not properly constrained. This is particularly dangerous because the affected systems are fully up-to-date, meaning traditional patching alone cannot immediately protect users. It underscores the importance of defense-in-depth: no single security tool should be trusted implicitly without compensating controls. Organizations face a window of exposure where a publicly released exploit exists but no vendor patch is yet available.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.