FalconFlank PoC Highlights CrowdStrike Falcon Privilege Escalation Risk

Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, has released FalconFlank, a zero-day proof of concept for privilege escalation involving CrowdStrike Falcon Sensor. The researcher said the PoC works on fully updated Windows 11 25H2 and Windows Server 2025 systems running CrowdStrike Falcon.

FalconFlank is described as abusing CrowdStrike Falcon Sensor’s remediation of malicious Office macros. The researcher stated in the project README that CrowdStrike may already have detections for the technique, meaning testers may need to add exclusions or alter the PoC’s DLL-loading method.

A remediation path becomes the focus

The release puts attention on endpoint-security workflows that take action on suspicious content. In this case, the claimed escalation route is tied specifically to remediation for malicious macros, rather than to an ordinary Office macro execution scenario.

The public material is a proof of concept, not a vendor-confirmed advisory. CrowdStrike had been contacted for comment, but no response was included in the report. Organisations should therefore treat the claims as an active item for validation in their own controlled environments, while awaiting any vendor guidance.

Part of a series of endpoint PoCs

FalconFlank follows other privilege-escalation research published by the same researcher. Days earlier, Chaotic Eclipse released HardBreacher, a PoC targeting Kaspersky endpoint security for Windows version 14.0.0.504. The researcher described that code as unreliable and said successful execution could create C:\Windows\System32\MY_SNAKE_IS_SOLID.dll with full permissions for the current user.

The researcher also published ShieldBreak, identified as CVE-2026-69414, a Microsoft Defender zero-day said to enable arbitrary code execution with NT AUTHORITY\SYSTEM privileges. It was assessed as a patch bypass for CVE-2026-50656, also known as RoguePlanet. LevelBlue described ShieldBreak as combining Cloud Files, Object Manager namespace manipulation, direct Windows Defender API invocation and a race in the remediation path.

What endpoint teams should do

For businesses using CrowdStrike Falcon, the immediate task is to review how macro-related remediation and exclusion policies are governed, and to monitor relevant endpoint activity. Testing should be confined to authorised environments, particularly because exclusions can reduce protection. The practical business implication is to validate detection and response controls without weakening the production security posture.