Researcher Releases Falcon Flank PoC Showing Privilege Escalation in CrowdStrike Falcon
Summary: A researcher using the handle Chaotic Eclipse published a proof-of-concept called FalconFlank, which abuses the Office malicious macros remediation in CrowdStrike Falcon Sensor to escalate privileges, and said it works on a fully updated Windows 11 25H2 or Windows Server 2025 machine with Falcon installed. CrowdStrike said it is investigating and advised customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting, stating customers remain protected through Cloud Anti-malware for Microsoft Office Files settings.
Bottom line: The same researcher released PoCs days earlier for a Kaspersky endpoint privilege escalation (HardBreacher, since patched) and a Microsoft Defender zero-day (ShieldBreak, CVE-2026-69414, still unfixed), and has said they will publish third-party bugs in the window before Patch Tuesday - meaning your endpoint agent, the control you rely on to catch everything else, is now the target.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-50656CVE-2026-69414
- Related