Researcher Publishes CrowdStrike Privilege Escalation Zero Day

A security researcher has published details of what appears to be a zero-day privilege escalation exploit in CrowdStrike.

The individual, identified by their online moniker “Nightmare Eclipse” (aka Infinite Nightmare, MSNightmare) posted the details to GitHub on September 3.

“FalconFlank is a zero-day privilege escalation that abuses the Office malicious macros remediation in CrowdStrike Falcon Sensor. Obviously by the time I drop this CrowdStrike would already have detections for it so if you want to test you either have to add it to the exclusions or obfuscate the PoC and change the dll load technique,” they wrote.

“As of now it works in a fully updated Windows 11 25H2 / Windows Server 2025 with CrowdStrike Falcon – Phase 3 Optimal Protection + needs ‘Microsoft Office file malicious macro removal’.”

Read more about zero days in security products: Hackers Chain Two New SonicWall Zero-Day Vulnerabilities.

A statement from CrowdStrike urged customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting while the firm investigates the case.

"Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings,” it added. “We refer customers to the FalconFlank Tech Alert in the CrowdStrike support portal."

That portal is only accessible for customers with a dedicated account, and there has not yet been a CVE assigned to the bug.

The Nightmare Continues

Security researcher Kevin Beaumont confirmed that FalconFlank works, while also highlighting that the same researcher also published zero-days exploiting Kaspersky and Avast.

“An open secret amongst security researchers is most cybersecurity products are crap at cybersecurity,” he wrote on Mastadon.

“From VPN products being one of the top causes of ransomware group entry, ../.. path traversal bugs, EDR products which brick PCs and are trivial to bypass and exploit etc.. It's a wild world out there.”

Oliver Spence, CEO of CybaVerse, agreed that security products can themselves be a risk to organizations.

“How do we fix this? Vendors need to take greater responsibility for ensuring their products are secure, continually testing for weaknesses and remediating vulnerabilities quickly,” he argued.

“Otherwise, customers will continue to face the financial and operational penalties of these weaknesses in the very products they depend on to secure them.”

NightmareEclipse was previously responsible for the “Exploitarium” dump of over 30 proof-of-concept exploits in open source projects, including the Linux kernel, Libssh2, FFmpeg, Gogs, and Gitea.