Your endpoint detection and response platform is supposed to be the last line of defense. It watches your endpoints, blocks threats, and remediates malware. It is the thing standing between you and a breach.
Now imagine that sentinel turns around and hands an attacker the keys to your entire network.
That is not a hypothetical. That is FalconFlank — a zero-day privilege escalation vulnerability in CrowdStrike Falcon Sensor that lets a low-privileged local user reach NT AUTHORITY\SYSTEM on fully updated Windows 11 and Windows Server 2025. No CVE. No patch. A working proof-of-concept dropped on GitHub for anyone to download.
Your EDR is now the attack vector.
What Happened
On September 3, 2026, a security researcher operating under the handle Chaotic Eclipse (also known as INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) published a proof-of-concept exploit to GitHub. The target: CrowdStrike Falcon Sensor, one of the most widely deployed EDR solutions in the enterprise world.
The exploit, dubbed FalconFlank, abuses a specific feature in the Falcon Sensor: the Microsoft Office File Suspicious Macro Removal policy. This is a remediation feature designed to protect endpoints from macro-based malware — one of the most common initial access vectors in the threat landscape.
Here is the irony that should keep every CISO awake tonight: the feature designed to remove malicious macros is the exact mechanism that FalconFlank weaponizes to plant a malicious DLL in a protected system directory.
How It Works
The attack flow is elegant in its simplicity:
- An attacker achieves low-privileged local code execution on a target endpoint (through phishing, another exploit, or any standard initial access vector)
- The attacker stages a specially crafted OLE-formatted file in the PowerShell v1.0 application directory
- When the Falcon Sensor macro remediation engine processes the file, it writes a DLL (bcrypt.dll) to C:\Windows\System32\WindowsPowerShell\v1.0\
- Because the write operation happens in SYSTEM context (Falcon own remediation pipeline runs elevated), the malicious DLL inherits full SYSTEM privileges
- When PowerShell subsequently loads bcrypt.dll from its application directory, the attacker code executes with NT AUTHORITY\SYSTEM
Five steps. From standard user to full SYSTEM control, weaponizing the very security tool that was supposed to protect the endpoint.
Important scope note: This is not remote code execution. The attacker needs existing local access. But in the post-exploitation phase — after an initial foothold is established — this is the kind of vulnerability that turns a minor incident into a complete network compromise.
The Pattern: Third Time Is Not the Charm
FalconFlank is not an isolated incident. It is the latest entry in a growing pattern of EDR remediation features being turned into attack vectors:
-
ShieldBreak (CVE-2026-69414) — August 2026: The same researcher published a PoC for a Microsoft Defender zero-day that abuses Windows Defender own clean engine to write a malicious DLL to System32, then triggers execution through Windows Error Reporting. No patch from Microsoft.
-
HardBreacher — Late August 2026: A privilege escalation flaw in Kaspersky endpoint security product that lets an attacker take over the UI process, causing the antivirus to completely lose it — stopping protection, granting or blocking access to files it should not control. Kaspersky has since patched.
-
FalconFlank — September 2026: CrowdStrike macro remediation feature weaponized for SYSTEM-level privilege escalation. No patch. No CVE.
Three EDR vendors. Three remediation pipeline abstractions. The same class of vulnerability: trusted security software performing privileged operations that can be intercepted and redirected by a low-privileged attacker.
This is not a bug in any single product. It is a systemic architectural weakness in how EDR platforms implement remediation features.
CrowdStrike Response
CrowdStrike is aware and investigating. Their interim guidance:
- Disable the Microsoft Office File Suspicious Macro Removal Windows policy setting — this is the specific feature being exploited
- Maintain Cloud Anti-malware for Microsoft Office Files settings — this provides partial protection
- Monitor the CrowdStrike support portal for the FalconFlank Tech Alert
The researcher noted that by the time they published the PoC, CrowdStrike likely already had detection logic deployed — but detections can be obfuscated, and the underlying vulnerability remains unpatched.
No CVE identifier has been assigned. No CVSS score exists. No timeline for a fix has been communicated.
What Makes This Different (and Worse)
The EDR industry has a trust problem that goes deeper than any single CVE:
Visibility gap. When a Falcon Sensor process writes a DLL to System32, does your SOC flag it? Probably not — because it is a trusted process performing a legitimate remediation operation. The entire detection model assumes the EDR itself is clean. FalconFlank breaks that assumption.
Remediation paradox. The more aggressively an EDR platform remediates threats (macro removal, file quarantine, memory scanning), the more privileged operations it performs — and the more attack surface it creates. Disabling the macro remediation feature reduces attack surface but also reduces protection. There is no clean trade-off.
No patch timeline. Unlike the Kaspersky HardBreacher (which was patched within days), CrowdStrike has not committed to a fix timeline. For organizations running Falcon Sensor across thousands of endpoints, disable this policy setting is not a real mitigation — it is a stopgap that creates a different risk.
PoC is public. The exploit code is on GitHub. The researcher explicitly stated that CrowdStrike probably already has detections, but also noted that obfuscation techniques can bypass them. The window between disclosure and weaponization is shrinking to hours, not weeks.
The Bigger Picture: EDR Trust Architecture Under Fire
FalconFlank is a symptom of a deeper problem in endpoint security architecture. EDR platforms have evolved from simple log collectors into complex orchestration engines that perform privileged operations: memory injection, file remediation, process termination, registry modification. Each of these operations is a potential attack surface.
The security industry built an entire defense paradigm around the idea that if you cannot trust your EDR vendor, you cannot trust anything. FalconFlank and its predecessors suggest that this trust model needs revision.
This is not about CrowdStrike being bad at security. CrowdStrike makes excellent security products. This is about a class of vulnerability that affects any product performing privileged remediation operations — and the industry has not yet developed the architectural patterns to make these operations safe.
What You Should Do Right Now
If your organization runs CrowdStrike Falcon:
- Disable the Microsoft Office File Suspicious Macro Removal policy setting per CrowdStrike guidance — this is the only known interim mitigation
- Audit your macro remediation logs — look for anomalous DLL writes to C:\Windows\System32\WindowsPowerShell\v1.0\ and unexpected SYSTEM shell spawns from Falcon Sensor processes
- Review detection rules — SOC Prime has published detection logic for FalconFlank exploitation, including monitoring for pipe creation events linked to Falcon Sensor processes
- Tighten local privilege controls — if you can prevent low-privileged users from reaching the PowerShell application directory, the attack chain is broken at step 2
- Monitor CrowdStrike support portal for the official patch — until a fix is available, the macro removal feature is a known attack surface
For all organizations running any EDR platform:
- Audit your remediation pipelines — which privileged operations does your EDR perform? Can a low-privileged user intercept or redirect any of them?
- Implement least-privilege more aggressively — the less access a standard user has to system directories, the harder this class of attack becomes
- Assume your EDR is not infallible — build detection for the detection tool
The Takeaway
The EDR industry implicit promise was: deploy our agent, and we will catch what you miss. FalconFlank flips that promise on its head: the agent you deployed to catch threats is itself a threat vector that no other tool is watching.
This is the third EDR vendor exploited in six weeks through the same architectural pattern. The lesson is not switch vendors. The lesson is that remediation is a privileged operation, and privileged operations are attack surfaces — regardless of which software performs them.
For GCC organizations running CrowdStrike Falcon (and there are many): the immediate priority is disabling the macro removal policy and monitoring for exploitation indicators. The strategic priority is rethinking the trust model — your EDR is a critical security control, but it is not a security boundary.
FalconFlank has no CVE, no patch, and no timeline. What it does have is a working PoC on GitHub and a growing class of imitators who have figured out that the best place to hide an attack is inside the tool designed to stop one.
The sentinel has turned. Time to watch the watcher.