FalconFlank PoC Claims Zero-Day Privilege Escalation in CrowdStrike Falcon

A Public PoC Targeting a Leading EDR

A security researcher operating under the handles Chaotic Eclipse (also known as INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has published a proof-of-concept exploit dubbed FalconFlank on GitHub, claiming a zero-day local privilege escalation vulnerability in CrowdStrike Falcon Sensor — one of the most widely deployed enterprise endpoint detection and response (EDR) products.

According to the project's README, FalconFlank "abuses the office malicious macros remediation in CrowdStrike Falcon Sensor" — meaning the exploit targets the very subsystem Falcon uses to automatically quarantine or clean malicious Microsoft Office macros, a process that runs with elevated permissions.

How It's Claimed to Work

The researcher notes that CrowdStrike "may already have detections for the flaw by now," and that testers may need to add exclusions or obfuscate the PoC to reproduce results — an indication that at least some signature-based detection may already be in place.

Status: Unverified, Vendor Not Yet Confirmed

This remains a researcher-disclosed claim, not a vendor-confirmed vulnerability. As of publication:

• No CVE identifier has been assigned.
• No official CrowdStrike advisory or patch has been published.
• The Hacker News reported it had reached out to CrowdStrike for comment and had not received a response at time of writing.

Independent confirmation of reliability, affected Falcon sensor version ranges, and mitigation guidance should come from CrowdStrike's official channels before organizations treat this as a confirmed, actively exploitable flaw.

Part of a Pattern Targeting Security Products

FalconFlank is not an isolated release from this researcher. Chaotic Eclipse has recently published proof-of-concept privilege escalation exploits against other major endpoint security products, including:

• HardBreacher — targeting Kaspersky Endpoint Security for Windows (v14.0)
• ShieldBreak — targeting Microsoft Defender

All three PoCs follow a similar theme: abusing a security product's own elevated remediation or protection logic to escalate privileges to SYSTEM, turning defensive tooling into an attack surface.

Recommended Actions for Falcon Customers

1. Contact CrowdStrike support/TAM for guidance and to confirm whether your sensor version is affected.
2. Monitor CrowdStrike's official trust/advisory portal for a statement or patch.
3. Review Falcon Sensor detections for anomalous macro-remediation activity or unexpected DLL loads tied to the remediation process.
4. Avoid downloading or running the public PoC on production systems — treat it as you would any unverified exploit code.
5. Maintain defense-in-depth — don't rely on a single EDR control; ensure application allow-listing and least-privilege account policies are in place independent of Falcon.

References

• The Hacker News — Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon
• GitHub — MSNightmare/FalconFlank

Related Reading

• Attackers Exploit Two SonicWall SMA 1000 Zero-Days in Active Attack Chain
• Critical Vulnerability in Claude Code Emerges Days After Source Leak