High
CrowdStrike, FalconFlank, Privilege Escalation, EDR, Endpoint, Zero-Day
FalconFlank: A CrowdStrike Falcon Privilege-Escalation 0-Day
FalconFlank is a released zero-day that escalates privileges by abusing CrowdStrike Falcon's macro remediation on fully updated Windows 11 25H2.
FalconFlank is a publicly released zero-day privilege-escalation exploit that abuses the office-macro remediation feature in CrowdStrike Falcon Sensor to gain elevated privileges on fully updated Windows 11 25H2 and Windows Server 2025 machines. The researcher known as Chaotic Eclipse dropped the proof-of-concept with a GitHub README, noting that CrowdStrike may already have detections, so testers would need to add exclusions or obfuscate the PoC and change the DLL-load technique. The flaw turns a security product's own remediation logic into a local escalation path, the recurring irony of EDR privilege-escalation research.
FalconFlank is part of a run of endpoint-security privesc PoCs from the same researcher. Days earlier they released HardBreacher, a privilege-escalation exploit for Kaspersky's Windows endpoint product (version 14.0.0.504), and last month a proof-of-concept against Microsoft Defender. The Kaspersky PoC, by the researcher's own admission, is rough and unreliable, but when it works it can take control of the security tool's UI process and, in their words, make the entire operating system a hot mess. The pattern matters more than any single tool: the software trusted to defend the endpoint is itself a high-value local target.
What does FalconFlank actually exploit?
It abuses Falcon's remediation for malicious Office macros, a trusted, high-privilege action the sensor performs, and turns it into a way to run code with elevated rights. Because the technique lives inside a legitimate defensive feature rather than a bolt-on driver, it does not require the attacker to bring their own vulnerable component. The PoC is written to run on a current, fully patched Windows build with Falcon present, which is what makes it notable: it targets the up-to-date, EDR-protected machine, not a neglected one.
Item | Detail |
|---|---|
Name | FalconFlank (zero-day privilege escalation) |
Affected | CrowdStrike Falcon Sensor on Windows 11 25H2 / Server 2025 |
Abuses | Falcon's Office malicious-macro remediation |
Researcher | Chaotic Eclipse (public PoC on GitHub) |
CVE | None assigned at disclosure |
Related PoCs | HardBreacher (Kaspersky), earlier Microsoft Defender PoC |
Caveat | CrowdStrike may already detect it; testing needs exclusions or obfuscation |
Why is privilege escalation the step that matters here?
Because on a modern endpoint, an attacker usually starts with limited user access and needs elevation to disable defenses, install persistence, or move laterally. A privilege-escalation flaw in the EDR itself is doubly useful, since the same product meant to catch that behavior is the thing being abused to achieve it. This is the class of bug that EPSS and KEV tend to underweight because it is local, not remote, yet a working public PoC on a fully patched machine is exactly the "public exploit exists" signal defenders should weight heavily.
Our read
An EDR privilege-escalation zero-day is a reminder that the security stack is attack surface too, and that "fully patched with EDR" is a posture to verify, not assume. The defensible move is behavioral: watch for abuse of the sensor's own remediation and privileged operations, and treat the endpoint agent as a monitored, testable component rather than an infallible guard. This is the case for supervised adversary simulation, emulating exactly this kind of local escalation against your own EDR to learn whether it would be caught before an attacker finds out for you.
Reporting by The Hacker News; PoC detail per the researcher's public release. Sources linked above.
Related: How to prioritize vulnerabilities and What is a zero-day?.