AUSTIN, September 9 — A security researcher going by the handle Chaotic Eclipse has publicly released a zero-day privilege escalation exploit targeting CrowdStrike Falcon, a cybersecurity platform used by organizations. The proof-of-concept, dubbed FalconFlank, takes aim at a remediation feature within the Falcon platform designed to strip malicious macros from Microsoft Office files. That feature operates with high privileges as part of the platform’s remediation capabilities.
Chaotic Eclipse found that this same high-privilege context can be abused. A low-privileged local user can leverage the macro removal process to escalate their access to a more powerful context.
The exploit works on fully updated Windows 11 25H2 and Windows Server 2025 systems running CrowdStrike Falcon with Phase 3 – Optimal Protection enabled, specifically when the malicious macro removal feature is active. Chaotic Eclipse added a notable caveat. CrowdStrike may already have deployed detections for the published proof-of-concept code itself.
However, the researcher noted that blocking the specific exploit technique does not necessarily mean the underlying vulnerability has been eliminated. The architectural weakness — privileged remediation tools becoming an attack pathway — could persist even if this particular implementation is stopped.
A Pattern of EDR Targeting
This release fits a broader body of work from the same researcher. Chaotic Eclipse, who also operates under the aliases INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse, has previously published zero-day exploits against other major anti-malware platforms. HardBreacher targeted Kaspersky Endpoint Security, triggering a privilege escalation flaw on fully patched Windows 11 25H2 running Kaspersky Endpoint version 14.0.0.504 that allowed creation of a DLL in System32 with full user permissions.
PrettyPrague exploited a vulnerability in Avast Sandbox to dump the Windows SAM database and obtain a SYSTEM-level shell, reportedly effective against fully patched Avast Antivirus and Windows 11 25H2, with potential extension to other Gen Digital products including AVG and Norton. The researcher has also released zero-day proofs-of-concept targeting Microsoft products directly, including Undefend and RedSun Defender.
A recurring pattern in Chaotic Eclipse’s work is public release following criticism of how vendors handled vulnerability reports.
CrowdStrike Responds
CrowdStrike issued a statement through a spokesperson: “We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting. Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. We refer customers to the FalconFlank Tech Alert in the CrowdStrike support portal.” The incident highlights a structural tension in modern cybersecurity architecture.
Endpoint detection and response products require elevated privileges to protect systems. Those same privileges create an expanded attack surface that can be turned against the system itself.
For security teams, the immediate priority is verifying their Falcon policy configuration and monitoring the CrowdStrike support portal for the referenced technical alert. The longer-term question is whether this disclosure prompts broader industry re-examination of how remediation capabilities are architected. What comes next depends on CrowdStrike’s investigation and whether the underlying vulnerability, distinct from the published proof-of-concept, requires a structural fix rather than a detection update.
