A security researcher known as Chaotic Eclipse has released FalconFlank, a proof-of-concept zero-day that escalates privileges on fully patched Windows machines running CrowdStrike Falcon. The researcher — who also uses the aliases Nightmare-Eclipse, MSNightmare, and INFINITE NIGHTMARE — published working exploit code to GitHub on September 3, 2026, without giving CrowdStrike advance notice.
No CVE ID or CVSS score has been assigned, and CrowdStrike has not confirmed the flaw. FalconFlank is a local privilege escalation exploit: it abuses Falcon's "Microsoft Office file malicious macro removal" remediation feature — a function that runs with high privileges — to spawn a command prompt with SYSTEM rights from an ordinary low-privileged account.
How FalconFlank Works
Falcon's macro-removal capability automatically inspects Office documents and strips malicious macros, operating with elevated privileges. According to the researcher's GitHub README, FalconFlank abuses that trusted cleanup routine so the security sensor acts on an attacker's behalf, turning its own remediation into a path to SYSTEM.
The exploit works on a fully updated Windows 11 25H2 or Windows Server 2025 host running Falcon in "Phase 3 Optimal Protection" with the macro-removal setting switched on. The researcher conceded that Falcon likely already detects the public PoC, so unmodified copies should be flagged — but the underlying weakness persists until CrowdStrike ships a fix.
Has CrowdStrike Patched It?
There is no patch as of publication. CrowdStrike says it is investigating and advises administrators to disable the "Microsoft Office File Suspicious Macro Removal" Windows policy setting as a temporary mitigation, adding that customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. The company points customers to its FalconFlank Tech Alert in the Falcon support portal.
What's Confirmed — and What Isn't
Confirmed: the PoC is public on GitHub, it targets Windows 11 25H2 and Server 2025 with Falcon's macro-removal enabled, and security researcher Kevin Beaumont verified that the privilege-escalation exploits Chaotic Eclipse dropped this week are real. Unconfirmed: any CVE or CVSS rating, official CrowdStrike confirmation, active exploitation in the wild, and which sensor builds are affected. Until CrowdStrike responds, defenders should disable the macro-removal policy, review the Tech Alert, and hunt for unexpected SYSTEM shells spawned during Office remediation on affected hosts.
Who Is Chaotic Eclipse?
FalconFlank is the latest in a prolific run of zero-days from Chaotic Eclipse, an anonymous researcher who has published working exploits for unpatched security products since April 2026 — framed as retaliation against Microsoft over disputed vulnerability reports and unpaid bounties.
The earlier releases targeted Windows and Microsoft Defender: BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), YellowKey (CVE-2026-45585), GreenPlasma (CVE-2026-45586), MiniPlasma (CVE-2020-17103), the Defender privilege-escalation flaw RoguePlanet (CVE-2026-50656), the GreatXML BitLocker bypass (CVE-2026-50661), and ShieldBreak, which defeated Microsoft's RoguePlanet patch.
Three of them — BlueHammer, RedSun and UnDefend — were exploited in real-world intrusions before fixes shipped and later added to CISA's Known Exploited Vulnerabilities catalog, so this researcher's proof-of-concept code has a history of reaching live attacks.
FalconFlank marks a pivot beyond Microsoft. This week alone, Chaotic Eclipse also released privilege-escalation exploits for Kaspersky (HardBreacher) and Avast (PrettyPrague), plus an Nvidia denial-of-service bug (GreenSection).