Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC

1. Executive summary

On 3 September 2026, the researcher known as Nightmare Eclipse (aliases Chaotic Eclipse, Infinite Nightmare, MSNightmare) published a working proof-of-concept for "FalconFlank", a zero-day local privilege escalation in CrowdStrike Falcon that abuses the Microsoft Office malicious macros remediation feature (the "Microsoft Office File Suspicious Macro Removal" Windows policy setting). The PoC reportedly works on fully updated Windows 11 25H2 and Windows Server 2025 running Falcon with Phase 3 — Optimal Protection and the macro-removal feature enabled. CrowdStrike is actively investigating and advises customers to disable the affected policy setting, stating that customers remain protected via the Cloud Anti-malware for Microsoft Office Files setting. No CVE has been assigned, no CVSS score exists in verified reference data, and the flaw is not listed on CISA KEV — severity is therefore unassessed at this stage, but the affected component is an endpoint security agent running with high privilege on Windows hosts, which is the population of greatest concern to EMEA financial services. Attribution of the research to Nightmare Eclipse is unconfirmed: the actor has no MITRE ATT&CK profile in our verified reference data. This is a researcher-disclosed PoC, not an observed in-the-wild campaign — no exploitation has been reported beyond the researcher's own testing and independent validation by Kevin Beaumont.

2. Regulatory framing

No NIS2 or UK NIS article is directly engaged by this item: there is no incident, no confirmed exploitation, and no client-side compromise — only a published PoC and vendor guidance.

3. Technical analysis & attack chain

Vulnerability class: Local privilege escalation (EoP) in a third-party Windows endpoint security product. No CVE assigned; no CVSS score in verified reference data; not on CISA KEV.

Affected component: CrowdStrike Falcon's Microsoft Office malicious macros remediation feature — an automated tool built into the platform that inspects Microsoft Office documents, strips suspect macro code, and is intended to prevent malicious code executing when a user opens the document. The Hacker News identifies the component as residing in the CrowdStrike Falcon Sensor.

Confirmed attack chain (as described by the researcher and corroborated by The Register / The Hacker News)

1. Preconditions. Attacker already has an unprivileged foothold on a target host — this is a privilege escalation, not an initial-access technique. Host must be running CrowdStrike Falcon with the malicious macro removal feature enabled and Phase 3 — Optimal Protection. Researcher states the PoC works on fully updated Windows 11 25H2 and Windows Server 2025.
2. Trigger the macro remediation path. The PoC causes the Falcon macro-remediation feature to process a crafted Microsoft Office document. The precise mechanism by which the remediation action is abused to escalate privileges is not disclosed in the available source material — the researcher's GitHub README and the FalconFlank Tech Alert (CrowdStrike support portal) are the primary technical references and were not available to us at time of writing.
3. Privilege escalation. The abuse of the remediation feature yields elevated privileges on the host. The researcher's note that testers may need to "change the dll load technique" implies a DLL load/hijack-style mechanism within the remediation path, but this is inference from a single phrase — treat the exact mechanism as unconfirmed pending the Tech Alert.
4. Post-exploitation. Not described in the source material. No payload, persistence, C2, or exfiltration capability is attributed to FalconFlank. Do not assume data theft or extortion; nothing in the sources indicates either.

Vendor position: CrowdStrike states it is actively investigating, advises customers to disable the "Microsoft Office File Suspicious Macro Removal" Windows policy setting, and states customers remain protected through the "Cloud Anti-malware for Microsoft Office Files" setting. CrowdStrike refers customers to the FalconFlank Tech Alert in its support portal. No patch was available at time of writing.

Independent validation: Kevin Beaumont confirmed the FalconFlank exploit works, along with several other PoCs the researcher released in the same week. This is a single named third-party validation reported through one outlet — corroboration is stronger than the researcher's claim alone, but the underlying technical detail remains single-sourced to the researcher's GitHub README.

Context — related same-week releases by the same researcher (all PoC-validated by Beaumont unless noted)

• HardBreacher — EoP in Kaspersky Endpoint Security. PoC reportedly works on fully patched Windows 11 25H2 with Kaspersky for Endpoint v14.0.0.504. Kaspersky did not respond to The Register's request for comment.
• PrettyPrague — EoP in Gen Digital's Avast antivirus. Per the researcher, it "will dump the SAM database by abusing a vulnerability in Avast Sandbox and spawn a full SYSTEM shell." Gen Digital confirmed awareness, initiated security response, and is developing a patch.
• GreenSection — memory corruption zero-day in Nvidia. Per Beaumont, it crashes the system (denial of service only). Nvidia did not respond to inquiries.

Confidence caveats: (1) Attribution to "Nightmare Eclipse" is unconfirmed — the actor has no MITRE ATT&CK profile in verified reference data. (2) The technical mechanism of FalconFlank is single-sourced to the researcher's GitHub README; no independent technical write-up was available. (3) No CVE, CVSS, or CISA KEV entry exists for any of the four flaws; all severity characterisations rest on researcher and press claims only. (4) No in-the-wild exploitation of any of these flaws is reported.

4. Mitigation & containment

P1 — within 24 hours

1. Disable the affected Falcon policy setting. Per CrowdStrike's guidance, disable the "Microsoft Office File Suspicious Macro Removal" Windows policy setting in the Falcon console. This is the vendor-recommended containment and it removes the vulnerable code path.
2. Confirm the compensating control is active. Verify that "Cloud Anti-malware for Microsoft Office Files" is enabled for all Falcon-managed Windows hosts, so macro-based threat coverage is retained after disabling the on-host remediation feature.
3. Pull the authoritative technical detail. Retrieve the FalconFlank Tech Alert from the CrowdStrike support portal and reconcile your Falcon sensor versions and policy configuration against it. Track for a vendor patch; none was available at time of writing.
4. Inventory exposure. Identify all Windows 11 25H2 and Windows Server 2025 hosts running Falcon with Phase 3 — Optimal Protection and macro remediation enabled; these are the confirmed-affected population per the researcher's testing.

P2 — within 72 hours

5. Hunt for anomalous privilege escalation on Falcon-managed hosts. Review EDR telemetry for unprivileged accounts obtaining SYSTEM or administrator context, unexpected child processes of the Falcon sensor or its Office-document handling path, and suspicious DLL loads associated with document processing. No FalconFlank-specific IOCs exist yet; hunt on behaviour.
6. Assess the sibling products. If Kaspersky Endpoint (HardBreacher, tested on v14.0.0.504), Avast (PrettyPrague — SAM database dump, SYSTEM shell via Avast Sandbox), or Nvidia drivers (GreenSection, system crash only) are present anywhere in the estate — including legacy, non-production, or acquired-environment hosts — record them against the vendor patch commitments and prioritise removal or patching. Gen Digital has a patch in development; Kaspersky and Nvidia had not responded publicly at time of writing.
7. Tighten macro exposure generally. Block macros in Office files from the internet (consistent with existing Microsoft guidance) to reduce the likelihood that the remediation path is exercised by hostile documents at all.

P3 — within 7 days

8. Patch on release. Apply the CrowdStrike fix when published, then re-enable the macro remediation policy setting if still required by your control framework.
9. Update third-party risk records. Record the event, the interim mitigation, and the compensating control in the CrowdStrike vendor risk file (DORA Art. 28) and in the resilience testing evidence base (DORA Art. 24).

5. Indicators of compromise

No indicators of compromise available in the source material. The sources describe a proof-of-concept vulnerability disclosure with no reported in-the-wild exploitation, no payload, and no atomic indicators. The researcher's GitHub README and the CrowdStrike FalconFlank Tech Alert are the likely sources of technical indicators once published; neither was available to us.

6. Detection

Insufficient indicators to author detection rules. The source material contains no file hashes, distinctive strings, command-line artefacts, file paths, registry keys, or network indicators attributable to the FalconFlank PoC. Authoring a rule that greps for the vulnerability name, product name, or researcher aliases would detect reporting about the threat, not the threat itself. Re-assess once the GitHub README or the CrowdStrike Tech Alert provides concrete artefacts.

7. Sources

• The Register — Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC — https://www.theregister.com/security/2026/09/03/prolific-microsoft-0-day-hunter-drops-crowdstrike-falcon-exploit-poc/5294318 — 2026-09-03
• The Hacker News — Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon — https://thehackernews.com/2026/09/researcher-releases-falconflank-poc.html — 2026-09

8. Adverse Trace position

Severity is unassessed pending vendor confirmation — no CVE, no CVSS score, and no CISA KEV entry exist in verified reference data, and we will not inflate severity from researcher or press claims alone. The practical risk to EMEA financial services is nonetheless material: FalconFlank targets the endpoint security agent itself on fully patched Windows 11 25H2 and Server 2025 hosts, a privileged component deployed across most financial estates, and the vendor's interim guidance is to disable a protection feature — a trade-off clients must make deliberately and document. We assess the likelihood of immediate in-the-wild exploitation as low-to-moderate: the PoC is public, the researcher states CrowdStrike likely already has detections for the unmodified exploit, and no exploitation has been reported, but public PoCs for EDR-agent EoP are exactly the class of tooling commodity actors and red teams adopt quickly. Attribution to Nightmare Eclipse is unconfirmed (no MITRE ATT&CK profile in verified reference data), and the technical mechanism is single-sourced to the researcher's GitHub README — verify against the CrowdStrike FalconFlank Tech Alert before enforcing configuration changes beyond the vendor-recommended policy disable. Adverse Trace will update this advisory when CrowdStrike publishes a patch or a CVE is assigned, when the Tech Alert or README yields concrete detection artefacts, and if any in-the-wild exploitation is observed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.