1. Executive summary
Between late August and early September 2026, the security researcher known as Nightmare Eclipse (aliases Chaotic Eclipse, Infinite Nightmare, MSNightmare) published proof-of-concept (PoC) exploit code for three zero-day privilege escalation or memory corruption vulnerabilities in third-party security and graphics products: FalconFlank (CrowdStrike Falcon Sensor), PrettyPrague (Avast Sandbox, potentially also other Gen Digital products including AVG and Norton), and GreenSection (Nvidia user-mode components). Independent researcher Kevin Beaumont has confirmed the Avast, CrowdStrike and Kaspersky exploits work. No CVE identifiers have been assigned to these flaws at time of writing, and none appear in CISA's Known Exploited Vulnerabilities catalogue — these are released PoCs, not observed in-the-wild campaigns. Attribution of the releases to the named researcher is unconfirmed by MITRE ATT&CK profiling (no actor profile exists); the bottom-line risk for EMEA financial services is that endpoint security agents deployed as core defensive controls can themselves be abused for local privilege escalation to SYSTEM on fully patched Windows hosts.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 24: digital operational resilience testing — general requirements | The affected products (CrowdStrike Falcon, Avast, Kaspersky, Nvidia components) are themselves security tooling whose privilege escalation flaws are only detectable by testing the security products' own attack surface — a distinct test scope beyond standard application testing. | Extend resilience testing programmes to include adversarial validation of endpoint agent attack surface (e.g. running released PoCs in isolated test estates against your own EDR build) rather than only testing applications the tools protect. |
| DORA Art. 28: ICT third-party risk — general principles | The vulnerabilities sit in ICT third-party security products (CrowdStrike, Gen Digital/Avast, Nvidia) where the researcher published working exploit code without advance vendor notice, meaning contractual patch/notice commitments could not mitigate disclosure timing. | Review third-party risk assessments for security tooling vendors to cover coordinated-disclosure expectations, out-of-band mitigation capability, and vendor response SLAs when no CVE exists to track against. |
No specific NIS2 article is directly engaged by this item beyond generic patching duties that would apply to any vulnerability disclosure.
3. Technical analysis & attack chain
Confirmed steps (as released, not as observed intrusions)
- An attacker with an existing low-privileged foothold on a Windows host (standard user) obtains the published PoC code from the researcher's public GitHub repositories.
- The PoC abuses a flaw in the target product's privileged component to escalate to SYSTEM privileges, spawning a full SYSTEM shell.
- With SYSTEM, the attacker proceeds to credential access, persistence, defence evasion or lateral movement using standard techniques — the endpoint agent itself is the escalation vector.
Per-exploit technical detail
FalconFlank CrowdStrike Falcon Sensor. Privilege escalation abusing the Microsoft Office malicious macros remediation feature in Falcon Sensor the automated mechanism that inspects Office documents and strips suspicious macro code before execution. Per the researcher's GitHub README, the PoC works on fully updated Windows 11 25H2 and Windows Server 2025 systems running CrowdStrike Falcon with Phase 3 – Optimal Protection and the malicious macro removal feature enabled. The researcher noted CrowdStrike would likely have detections for the published PoC and that testing requires adding it to exclusions or obfuscating the PoC and changing the DLL load technique — indicating the exploit involves DLL loading within the macro-remediation path. CrowdStrike's mitigation is to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting; the vendor states customers remain protected via the Cloud Anti-malware for Microsoft Office Files setting. No CVE assigned. Kevin Beaumont confirmed this exploit works.
PrettyPrague Avast Sandbox (Gen Digital). Privilege escalation targeting the Avast sandbox component. Per the researcher, the PoC "will dump the SAM database by abusing a vulnerability in Avast Sandbox and spawn a full SYSTEM shell." The researcher states it may also affect other Gen Digital products, including AVG and Norton. Gen Digital confirmed awareness of a vulnerability "affecting a subset of Gen products, including Avast Antivirus, that could allow an attacker to elevate their system privileges"; the vendor initially told The Register it was developing a patch and subsequently told SecurityWeek the issue has been fixed, urging users to keep products updated. No CVE assigned. Beaumont confirmed this exploit works.
GreenSection Nvidia user-mode components. An out-of-bounds memory write affecting a shared global memory section used by multiple Nvidia user-mode components. Per the researcher, this does not yield SYSTEM immediately but "can be used cross user to user boundary easily or even compromise the dwm.exe process." The researcher did not develop a full exploit and invited others to do so. Per Beaumont, the current PoC just crashes the system. No vendor response from Nvidia at time of reporting. No CVE assigned.
Related context: In late August the same researcher released HardBreacher, an elevation-of-privileges bug in Kaspersky Endpoint Security v14.0.0.504 on fully patched Windows 11 25H2; Kaspersky patched it on 31 August 2026. The researcher also recently released Windows zero-days dubbed LegacyHive and ShieldBreak (the latter dropped on a Patch Tuesday, spawning a SYSTEM-privileged shell), per SecurityWeek reporting. These confirm a sustained, multi-vendor disclosure campaign.
Confidence caveats: All technical claims about exploit mechanics originate from the researcher's own GitHub READMEs and statements, relayed via vendor-confirmed reporting (The Register, SecurityWeek, The Hacker News, DataBreaches.net). Beaumont's independent confirmation covers the Avast, CrowdStrike and Kaspersky exploits; GreenSection is single-sourced to the researcher (Beaumont only confirms it crashes the system, not exploitability). The researcher published FalconFlank without giving CrowdStrike advance notice. No CVE IDs, CVSS scores, or CISA-KEV entries exist for any of these flaws — severity cannot be scored from verified reference data, and none should be inferred. There is no evidence of in-the-wild exploitation; the risk is that public PoC code lowers the barrier for any attacker with local access.
4. Mitigation & containment
P1 — within 24 hours
- CrowdStrike Falcon estates: Disable the Microsoft Office File Suspicious Macro Removal Windows policy setting per CrowdStrike's guidance (see the FalconFlank Tech Alert in the CrowdStrike support portal). Verify the Cloud Anti-malware for Microsoft Office Files setting remains enabled CrowdStrike states this maintains protection. Confirm Falcon sensor policy is not relying solely on the macro-remediation path for Office-borne threats.
- Avast/AVG/Norton estates: Confirm Gen Digital products are updated to builds containing the fix (vendor states the issue is fixed); force update checks on endpoints running Avast Antivirus and related Gen products.
P2 — within 72 hours
- Nvidia estates: No vendor fix is available. Assess exposure of endpoints with Nvidia user-mode drivers/components; monitor for the researcher or others publishing a full dwm.exe compromise chain. Treat the current PoC as a denial-of-service (system crash) risk on such hosts.
- Kaspersky estates (if applicable): Confirm endpoints are on builds patched on/after 31 August 2026 for HardBreacher (affects Kaspersky Endpoint Security v14.0.0.504).
- Hunt for signs of local privilege escalation attempts against security agents: EDR telemetry showing DLL load anomalies in agent processes, sandbox or macro-remediation subprocess crashes, or unexpected SAM database access (
SAMfile reads,reg save HKLM\SAM) from non-standard processes.
P3 — within 7 days
- Track vendor advisories for CVE assignment and formal patches for FalconFlank and GreenSection; re-enable the CrowdStrike macro-removal policy only when CrowdStrike confirms a fix.
- Add the PoC repositories' published code patterns to EDR exclusions review — do not create broad exclusions for testing; use isolated test VMs only.
- Review whether endpoint agents run with unnecessary privileged services or writable paths that could serve as escalation primitives, and raise with vendors under DORA Art. 28 third-party risk processes.
5. Indicators of compromise
No indicators of compromise available in the source material. The sources describe released PoC code and vulnerability mechanics, not an intrusion; no hashes, domains, IPs, or file artefacts from the exploits themselves are published in the provided material.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Local privilege escalation to SYSTEM via security-agent components (Falcon macro-remediation path, Avast Sandbox) | EDR process telemetry: SYSTEM shell spawned from agent subprocess context on Windows 11 25H2 / Server 2025 | High (exploit confirmed working by Beaumont) |
| SAM database dump preceding SYSTEM shell (PrettyPrague chain) | EDR/Sysmon: access to HKLM\SAM / C:\Windows\System32\config\SAM by unexpected processes |
High (researcher-stated capability, exploit confirmed) |
| Out-of-bounds write to shared Nvidia global memory section causing crash or dwm.exe compromise | Windows Event Log application crashes in dwm.exe or Nvidia user-mode components; WER reports |
Medium (PoC crash confirmed; full exploit not demonstrated) |
| DLL load technique within Office macro-remediation path (FalconFlank) | Falcon sensor telemetry; Sysmon Event ID 7 (image load) in agent processes | Medium (implied by researcher's obfuscation note; exact technique not published) |
6. Detection
Insufficient indicators to author detection rules. The sources contain no exploit file hashes, distinctive strings, mutexes, registry keys, or command-line artefacts from the PoC binaries themselves; the only technical identifiers are product/feature names and researcher statements, which are not threat artefacts suitable for YARA or Sigma rules. Recommend behavioural monitoring per §5 pending vendor advisories with concrete detection guidance.
7. Sources
- SecurityWeek — Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits — https://www.securityweek.com/nightmare-eclipse-drops-crowdstrike-nvidia-avast-zero-day-exploits/ — 2026-09-07
- The Register Security — Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC — https://www.theregister.com/security/2026/09/03/prolific-microsoft-0-day-hunter-drops-crowdstrike-falcon-exploit-poc/5294318 — 2026-09-03
- The Hacker News — Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon — https://thehackernews.com/2026/09/researcher-releases-falconflank-poc.html — 2026-09
- DataBreaches.net — FalconFlank Zero-Day Hits CrowdStrike Falcon Sensor — https://databreaches.net/2026/09/05/falconflank-zero-day-hits-crowdstrike-falcon-sensor/ — 2026-09-05
- SecurityWeek — Nightmare Eclipse Drops 'LegacyHive' Windows Zero-Day — https://www.securityweek.com/nightmare-eclipse-drops-legacyhive-windows-zero-day/ — 2026 (related context)
- SecurityWeek — Nightmare Eclipse Drops Windows Zero-Day Exploit 'ShieldBreak' — https://www.securityweek.com/nightmare-eclipse-drops-windows-zero-day-exploit-shieldbreak/ — 2026 (related context)
8. Adverse Trace position
This is a credible, independently confirmed (for FalconFlank, PrettyPrague and HardBreacher) set of privilege escalation flaws in endpoint security products themselves — the tools EMEA financial services clients rely on as primary controls — with public PoC code and no CVEs yet assigned, so standard CVE-driven patch pipelines will not surface them. Severity cannot be formally scored from verified reference data (no CVSS, no CISA-KEV entries), but the practical risk is high on any estate where a low-privileged attacker already has local execution: SYSTEM shell on fully patched Windows 11 25H2 / Server 2025 via the Falcon macro-remediation path, and SAM dump plus SYSTEM via Avast Sandbox. Attribution of the releases to "Nightmare Eclipse" is unconfirmed — no MITRE ATT&CK profile exists for this actor, and the identity rests on researcher self-identification across aliases; this is a disclosure event, not an attributed campaign, and there is no evidence of in-the-wild exploitation to date. Clients should action the CrowdStrike policy change and Avast updates immediately, monitor for CVE assignment, and fold security-agent attack surface into resilience testing under DORA Art. 24. Adverse Trace will update this advisory when vendors publish CVEs, patches, or detection guidance, or if any in-the-wild abuse of these PoCs is observed.
Published via PulseTrace — Adverse Trace threat intelligence.