GoKawiilResearcher publishes 'FalconFlank' zero-day exploiting CrowdStrike Falcon on Windows 11/Server 2025
A researcher going by 'Nightmare Eclipse' released a privilege-escalation exploit dubbed FalconFlank that abuses CrowdStrike Falcon's malicious macro remediation feature to gain SYSTEM-level command prompt access on fully patched Windows 11 25H2 and Windows Server 2025 machines. The flaw has no CVE yet, and CrowdStrike says it is investigating while telling customers to disable the Office File Suspicious Macro Removal policy setting as a workaround.
GoKawiil's interpretation of the reporting above, not reported fact.
The exploit shows how security tools themselves can become attack vectors when their remediation features are weaponized, undermining trust in endpoint protection software. Because the vulnerability affects fully updated systems and lacks a public patch or CVE, defenders must rely on a mitigation that disables part of Falcon's own protection, leaving a temporary security gap.
- FalconFlank lets attackers gain SYSTEM privileges by abusing CrowdStrike Falcon's macro remediation feature.
- It affects fully patched Windows 11 25H2 and Windows Server 2025 systems, with no CVE assigned yet.
- CrowdStrike recommends disabling a specific Office macro-removal policy setting as a temporary workaround while it investigates.
Yubico YubiKey 5 NFC Security Key — When endpoint defenses like CrowdStrike Falcon get bypassed by a fresh zero-day, strong account security is the layer you still control. The YubiKey 5 NFC adds hardware-backed phishing-resistant two-factor authentication to Windows logins, Microsoft accounts, and password managers via USB-A or a tap over NFC. It's a simple, durable key that keeps working even when software protections are under scrutiny.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-04
Published there as: “New CrowdStrike 'FalconFlank' zero-day grants SYSTEM privileges”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.