An anonymous security researcher who uses the “Nightmare Eclipse” handle released a CrowdStrike Falcon zero-day exploit named “FalconFlank” that lets attackers escalate privileges on up-to-date Windows systems.
Nightmare Eclipse says the new vulnerability (which has yet to be assigned a CVE ID) affects devices running the latest versions of Windows 11 and Windows Server, as well as CrowdStrike’s endpoint security platform.
Successful exploitation allows attackers to spawn a command prompt with SYSTEM privileges by abusing CrowdStrike Falcon’s Office malicious macros remediation feature.
“FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon Sensor, obviously by the time I drop this Crowdstrike would already have detections for it so if you want to test you either have to add it to the exclusions or obfuscate the PoC and change the dll load technique,” Nightmare Eclipse said. “As of now it works in a fully updated windows 11 25H2 / Windows Server 2025 with Crowdstrike Falcon.”
When BleepingComputer asked for more details about this vulnerability, a CrowdStrike spokesperson said the company is investigating the researcher’s claims and advised customers to disable the Microsoft Office Windows policy setting that toggles the security software’s File Suspicious Macro Removal feature.
“We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting,” the spokesperson told BleepingComputer. “Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. We refer customers to the FalconFlank Tech Alert in the CrowdStrike support portal.”
Although the company also shared this link to the tech alert regarding the FalconFlank zero-day exploit, the advisory is not public, and customers can access it only if they have an account on CrowdStrike’s support portal.
This week, Nightmare Eclipse has also released privilege escalation zero-day exploits for Kaspersky Antivirus for Endpoint (named HardBreacher) and GenDigital Avast Antivirus (PrettyPrague), as well as a denial-of-service zero-day for Nvidia (named GreenSection) that will crash the system.
Cybersecurity expert Kevin Beaumont confirmed on Thursday that the privilege escalation exploits released by Nightmare Eclipse this week are real and work.
Nightmare Eclipse has also disclosed multiple zero-day exploits targeting multiple Microsoft products since April, including Microsoft Defender, BitLocker, and various other Windows components.
These Microsoft zero-days are known as LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend. While the LegacyHive, RoguePlanet, YellowKey, GreenPlasma, and MiniPlasma flaws have since been fixed, the other security flaws remain zero-days and are still awaiting an official patch.
After Nightmare Eclipse disclosed the first zero-days, Microsoft responded with warnings of legal action against people engaging in “malicious activity causing real harm to our customers,” prompting many to believe that the company was directly threatening the security researcher.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Sonicwall warns of new SMA1000 zero-day exploited in attacks
Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks
ServiceNow warns of three max severity security vulnerabilities
CISA: Windows Task Host flaw now exploited by ransomware gangs
Microsoft working on Defender patch for ShieldBreak zero-day
Plex warns users to patch security vulnerabilities immediately
Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks
Recently patched PaperCut zero-days used in data theft attacks
Unify ransomware protection and recovery for every client
Can you trust every session? See how session enrichment enables better authentication decisions.
Identity, Data Governance & Threat Detection in One Platform: Take our In-Browser Tour
AI-driven vulnerability discovery is accelerating. See how Action1 helps remediation keep pace.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
