FalconFlank Zero-Day Exposes Privilege Escalation in CrowdStrike Falcon
Security researcher Chaotic Eclipse disclosed a new zero-day exploit targeting CrowdStrike Falcon's sensor. The vulnerability could allow attackers to escalate privileges on affected systems.
TL;DR
- A new zero-day exploit called FalconFlank targets CrowdStrike Falcon.
- It enables privilege escalation by exploiting office macro remediation features.
- The flaw was disclosed by security researcher Chaotic Eclipse.
- Organizations using CrowdStrike Falcon should monitor for updates and mitigation guidance.
- This vulnerability highlights ongoing risks in endpoint detection and response platforms.
A recently disclosed zero-day vulnerability, named FalconFlank, poses a significant risk to organizations relying on CrowdStrike Falcon for endpoint protection. Discovered and released publicly by security researcher Chaotic Eclipse, the flaw exploits a component related to malicious macro remediation within the Falcon sensor.
The vulnerability enables local privilege escalation, potentially allowing attackers with limited access to gain higher-level permissions on compromised systems. Given CrowdStrike Falcon’s widespread use in enterprise environments, this disclosure underscores the importance of continuous monitoring and rapid patching processes.
About the Vulnerability
- FalconFlank abuses the office macro remediation functionality in CrowdStrike Falcon Sensor.
- It is a local privilege escalation flaw, requiring initial system access.
- No official patch from CrowdStrike is available yet, increasing exposure risk.
- The exploit has been demonstrated via a public proof-of-concept (PoC) release.
Impact and Recommendations
- Organizations using CrowdStrike Falcon should assess their exposure immediately.
- CrowdStrike currently advises disabling the Microsoft Office File Suspicious Macro Removal Windows policy setting while they investigate; see their statement below.
- Defensive teams should monitor endpoint logs for suspicious activity related to macro handling.
- Apply vendor patches as soon as they become available.
- Consider network segmentation and least-privilege policies to limit potential impact.
- Stay informed through CrowdStrike's official advisories and trusted security feeds.
CrowdStrike response
On 7 September 2026, a CrowdStrike spokesperson provided the following statement (no individual name attached):
"We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting. Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. We refer customers to the FalconFlank Tech Alert in the CrowdStrike support portal." — CrowdStrike spokesperson
As of this update there is still no public patch. The FalconFlank Tech Alert is available to CrowdStrike customers via the support portal (not a public advisory). Disabling the Microsoft Office File Suspicious Macro Removal policy removes that Falcon feature while the investigation continues; treat the “remain protected” claim as vendor guidance, not independent confirmation that the local privilege-escalation path is closed.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.