# CrowdStrike Falcon Zero-Day 'FalconFlank' Grants SYSTEM Privileges

> A newly disclosed zero-day, 'FalconFlank,' abuses CrowdStrike Falcon's macro remediation to grant SYSTEM privileges on Windows systems.

- Published: 2026-09-06T11:51:31.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: Crowdstrike Falcon, Privilege Escalation, Zero-Day, Windows, Endpoint Security
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/new-crowdstrike-falconflank-zero-day-grants-system-privileges/
- Canonical: https://runtimerebel.com/blog/crowdstrike-falcon-zero-day-falconflank-grants-system-privileges

## Key points

- Immediate impact: Attackers can gain SYSTEM privileges on Windows systems running CrowdStrike Falcon.
- Affected systems: Windows 11 25H2, Windows Server 2025, and CrowdStrike Falcon sensor versions.
- Remediation: Disable the Microsoft Office File Suspicious Macro Removal Windows policy setting.

## FalconFlank [Zero-Day](/glossary#zero-day) Exposes CrowdStrike Falcon to [Privilege Escalation](/glossary#privilege-escalation)

An anonymous security researcher known as "Nightmare Eclipse" has publicly disclosed a zero-day [exploit](/glossary#exploit), dubbed "FalconFlank," that allows for privilege escalation to SYSTEM-level access on up-to-date Windows systems running CrowdStrike Falcon [endpoint](/glossary#endpoint) security. This [vulnerability](/glossary#vulnerability) impacts devices using the latest versions of Windows 11 and Windows Server, alongside the CrowdStrike Falcon platform, as reported by [BleepingComputer](https://www.bleepingcomputer.com/news/security/new-crowdstrike-falconflank-zero-day-grants-system-privileges/).

### Technical Details of the FalconFlank Exploit

The FalconFlank exploit specifically abuses CrowdStrike Falcon's Office malicious macros remediation feature. By manipulating this functionality, attackers can spawn a command prompt with SYSTEM privileges. The researcher confirmed that the exploit is functional on "fully updated Windows 11 25H2 / Windows Server 2025 with Crowdstrike Falcon." Cybersecurity expert Kevin Beaumont independently verified that the privilege escalation exploits released by Nightmare Eclipse this week, including FalconFlank, are legitimate and operational.

While the vulnerability is severe, it has not yet been assigned a [CVE](/glossary#cve) ID. CrowdStrike is actively investigating these claims. In response to the disclosure, a CrowdStrike spokesperson advised customers to disable a specific Microsoft Office Windows policy setting related to the security software's File Suspicious Macro Removal feature. They also stated that "Customers remain protected through the Cloud Anti-[malware](/glossary#malware) for Microsoft Office Files settings" and referred users to a non-public "FalconFlank Tech Alert" on their support portal.

Nightmare Eclipse has been prolific in disclosing zero-days, recently releasing similar privilege escalation exploits for Kaspersky Antivirus for Endpoint ("HardBreacher") and GenDigital Avast Antivirus ("PrettyPrague"), as well as a denial-of-service zero-day for Nvidia ("GreenSection"). This broader pattern highlights a trend of researchers scrutinizing endpoint security products for vulnerabilities.

### Analysis: Why SYSTEM Privileges Matter for Endpoint Security

Gaining SYSTEM privileges on a compromised machine is a critical step for attackers. With SYSTEM-level access, an adversary effectively controls the entire operating system, bypassing most security controls and performing actions typically reserved for administrators or the OS kernel itself. This level of access allows for deep-seated [persistence](/glossary#persistence) mechanisms, the ability to disable security software, exfiltrate sensitive data, or deploy further malicious payloads such as [ransomware](/glossary#ransomware).

The fact that this particular **CrowdStrike Falcon privilege escalation exploit** leverages a remediation feature within the security product itself is particularly concerning. It underscores the sophisticated nature of modern exploits, which often target the very tools designed to protect systems. Defenders must be vigilant, as a successful exploitation could negate many of the protective measures offered by the endpoint detection and response ([EDR](/glossary#edr)) solution, making it harder to detect and contain post-exploitation activity.

### Addressing CrowdStrike Falcon Privilege Escalation Exploit: Mitigation Strategies

Immediate action is required for organizations running CrowdStrike Falcon. Based on CrowdStrike's guidance, the primary mitigation for the **FalconFlank zero-day mitigation** involves a specific policy adjustment:

*   **Disable Microsoft Office File Suspicious Macro Removal Policy:** Customers are strongly advised to **disable the Microsoft Office File Suspicious Macro Removal Windows policy setting**. This action, while potentially impacting a specific remediation capability, is recommended by CrowdStrike to prevent exploitation of the FalconFlank vulnerability. Organizations should consult the FalconFlank Tech Alert within the CrowdStrike support portal for detailed, product-specific instructions.
*   **Monitor for Suspicious Activity:** Even with the recommended policy changes, organizations should enhance their monitoring for any unusual activity indicative of privilege escalation attempts or unauthorized SYSTEM-level processes. This includes scrutinizing process creation events, changes to critical system files, and suspicious network connections originating from compromised endpoints.

Given the confirmed functionality of this zero-day exploit, prompt implementation of CrowdStrike's recommended policy change is essential to maintain the integrity of affected systems and prevent potential SYSTEM-level compromises. Organizations should also prepare for future updates from CrowdStrike as they continue their investigation and work towards a permanent [patch](/glossary#patch).

**Related:** [Windows LegacyHive Zero-Day Exploit Grants Admin Access — Patch Status](/blog/windows-legacyhive-zero-day-exploit-grants-admin-access-patch-status), [ShieldBreak: Windows Zero-Day EoP via Microsoft Defender](/blog/shieldbreak-windows-zero-day-eop-via-microsoft-defender)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/crowdstrike-falcon-zero-day-falconflank-grants-system-privileges