A security researcher known as Chaotic Eclipse has released FalconFlank, a proof-of-concept zero-day that escalates privileges on fully patched Windows machines running CrowdStrike Falcon. Published on 3 September 2026, with reporting on 5 September, FalconFlank is a local privilege escalation exploit that abuses CrowdStrike Falcon’s “Microsoft Office file malicious macro removal” remediation feature, a function that runs with high privileges.
The exploit code was made publicly available on GitHub, and CrowdStrike has not publicly confirmed the flaw or assigned a CVE. The article notes there is no CVSS score yet.
FalconFlank reportedly works by turning Falcon’s macro-removal cleanup routine—which inspects Office documents and strips malicious macros and operates with elevated privileges—into a pathway for an attacker to spawn a command prompt with SYSTEM rights from a normal, low-privileged account. In effect, the security sensor’s remediation becomes a foothold for privilege escalation.
The reporting cites CyberKendra and references coverage from BleepingComputer, but emphasises that, at this time, there is no official confirmation or CVE from CrowdStrike. The practical response for affected organisations would hinge on vendor confirmation and any published mitigations, though the article does not detail specific fixes or workarounds beyond noting the nature of the exploit.