"FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in CrowdStrike Falcon," the researcher known as Chaotic Eclipse wrote in a GitHub README accompanying a public proof-of-concept.
FalconFlank: the public PoC and its mechanics
The researcher — identified in publications as Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) — released a proof-of-concept named FalconFlank that the README describes as a zero-day privilege escalation affecting the CrowdStrike Falcon Sensor. According to the author, the exploit specifically "abuses the office malicious macros remediation" path inside the Falcon product.
Chaotic Eclipse cautioned testers that CrowdStrike "may already have detections for the flaw by now" and recommended that anyone experimenting with the PoC either add it to product exclusions or "obfuscate the PoC and change the DLL load technique" to avoid triggering detections. The researcher reported the PoC functions on a fully updated Windows 11 25H2 machine and on Windows Server 2025 when CrowdStrike Falcon is present.
Scope and observable effects reported
The published material ties FalconFlank to local privilege escalation — an elevation of a user's rights inside a Windows environment — via the Falcon sensor's remediation flow for malicious Office macros. The researcher did not provide a CVE identifier for FalconFlank in the README excerpt quoted, and the public disclosure arrived before any statement from CrowdStrike included in the source material.
The Hacker News report states it has contacted CrowdStrike for comment and will update the story if the company responds.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogA string of recent disclosures by the same researcher
FalconFlank follows a series of PoCs Chaotic Eclipse has published in recent weeks. Days earlier the researcher released HardBreacher, a privilege-escalation PoC targeting Kaspersky's endpoint security product for Windows, specifically version 14.0.0.504. The HardBreacher PoC, the researcher said, is "not in the best shape at all" but, when it succeeds, creates a file at C:\Windows\System32\MY_SNAKE_IS_SOLID.dll with full permissions for the current user and can lead to serious corruption of Kaspersky's UI process and file access controls.
Last month the researcher published ShieldBreak (aka CVE-2026-69414), described as a Microsoft Defender zero-day that could allow arbitrary code execution with NT AUTHORITY\SYSTEM privileges. The source notes Microsoft "has yet to release a fix" for ShieldBreak. In published commentary, security firm LevelBlue characterized ShieldBreak as a chain combining Cloud Files, Object Manager namespace manipulation, direct Windows Defender API invocation, and a timing race in the remediation path; LevelBlue described ShieldBreak as redirecting Defender's clean engine to write an attacker-supplied DLL to C:\Windows\System32\phoneinfo.dll followed by SYSTEM execution via the built-in Windows Error Reporting task.
What this means for CrowdStrike customers, enterprise buyers, and threat actors
- CrowdStrike customers and Windows administrators: The researcher explicitly warned testers that the PoC may trigger detections and suggested adding the exploit to exclusions or changing the payload and DLL load technique to test it. The disclosure asserts the PoC runs on fully updated Windows 11 25H2 and Windows Server 2025 hosts with Falcon installed.
- Enterprise procurement and security leaders: The public release adds to an emergent pattern in which zero-day PoCs targeting endpoint security products appear in quick succession. Organizations that manage endpoint deployments and vendor relationships will need to monitor vendor advisories and any subsequent mitigations from CrowdStrike.
- Adversaries and researchers: A working, public PoC means the technical details are accessible to third parties. Earlier PoCs from the same researcher — including ones that write DLLs into System32 or otherwise attain SYSTEM-level execution — demonstrate the practical potential of such chains if they succeed in a target environment.
Vendor engagement and the researcher’s claims
Chaotic Eclipse has publicly described difficulty engaging with some vendors. In a post dated August 14, 2026, the researcher complained that Microsoft "continues to ghost them and refuses to engage in 'any sort of communication,'" adding that Microsoft is "trying hard to paint me as some insane criminal." The researcher further said they cannot report bugs to vendors because of restrictions the researcher attributes to Microsoft and expressed frustration at the lack of response.
Separately, The Hacker News report states it has reached out to CrowdStrike for comment about FalconFlank; no response from CrowdStrike is included in the source material.
Chaotic Eclipse’s recent string of public PoCs — across Kaspersky, Microsoft Defender, and now CrowdStrike Falcon — presents a compact record of high-impact endpoint-remediation techniques being weaponized in lab code. Whether vendors will publish mitigations or detections for FalconFlank remains unreported in the source material; the public disclosure and the researcher’s warnings about detection suggest defenders and buyers should watch for any subsequent advisories from CrowdStrike and observe whether the company confirms or rebuts the researcher’s technical claims.
