{"id":2666,"date":"2026-09-03T07:17:31","date_gmt":"2026-09-03T07:17:31","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2666"},"modified":"2026-09-03T07:17:31","modified_gmt":"2026-09-03T07:17:31","slug":"researcher-releases-falconflank-poc-showing-privilege-escalation-in-crowdstrike-falcon","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2666","title":{"rendered":"Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 03, 2026<\/span><\/span>Vulnerability \/ Endpoint Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The security researcher known as Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has dropped a new zero-day dubbed FalconFlank<\/strong>, a privilege escalation flaw impacting Crowdstrike Falcon.<\/p>\n

\u00abFalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in CrowdStrike Falcon Sensor,\u00bb the researcher said<\/a> in a GitHub README file, adding the cybersecurity company may already have detections for the flaw by now.<\/p>\n

\u00abSo if you want to test, you either have to add it to the exclusions or obfuscate the PoC and change the DLL load technique.\u00bb<\/p>\n

The PoC, the researcher added, works in a fully updated Windows 11 25H2 machine or Windows Server 2025 with Crowdstrike Falcon. The Hacker News has contacted CrowdStrike for comment, and we will update the story if we hear back.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The development comes days after Chaotic Eclipse released a PoC for another privilege escalation flaw impacting Kaspersky’s endpoint security product for Windows (version 14.0.0.504). The exploit has been codenamed HardBreacher<\/a>.<\/p>\n

\u00abThe PoC is not in the best shape at all, it is basically duct tapped, I just managed to make it work and that’s all,\u00bb the researcher said. \u00abIt will fail to run with error so you just have to keep rerunning it. If it succeeds, it will create a file in C:\\Windows\\System32\\MY_SNAKE_IS_SOLID.dll with full permissions for the current user.\u00bb<\/p>\n

\u00abThe interesting part about this is that Kaspersky completely loses it when you take control over the UI process, you can cause it to stop functioning, grant\/block access to files it’s not supposed to, if the PoC succeeds, the entire operating system becomes a hot mess.\u00bb<\/p>\n

Last month, the researcher also published a PoC for a Microsoft Defender zero-day called ShieldBreak (aka CVE-2026-69414) that could grant an attacker<\/a> the ability to run arbitrary code with NT AUTHORITY\\SYSTEM privileges. It’s assessed to be a patch bypass for CVE-2026-50656 (aka RoguePlanet). Microsoft has yet to release a fix.<\/p>\n

\u00abLike its predecessors, ShieldBreak explores a different corner of the Windows operating system,\u00bb LevelBlue said<\/a>. \u00abWhere RedSun abused the Cloud Files API and TieringEngineService to redirect a Defender write into System32, and LegacyHive weaponized offline registry hive manipulation and the NT Object Manager namespace, ShieldBreak combines Cloud Files, Object Manager namespace manipulation, direct Windows Defender API invocation, and a timing race in the remediation path.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abThe result is a self-contained local privilege escalation chain in which Windows Defender’s own clean engine is redirected to write an attacker-supplied DLL to C:\\Windows\\System32\\phoneinfo.dll, followed by SYSTEM execution through the built-in Windows Error Reporting task.\u00bb<\/p>\n

Shortly after, the researcher claimed that Microsoft continues to ghost them and refuses to engage in \u00abany sort of communication,\u00bb stating<\/a> the company is \u00abtrying hard to paint me as some insane criminal.\u00bb<\/p>\n

\u00abI can’t even report the bugs I find to their respective vendors because of the restrictions by Microsoft, all of this is of their own doing and you know, they don’t even bother to check my case to figure out what’s wrong,\u00bb they said<\/a> in a post dated August 14, 2026.<\/p>\n

\u00abThink I will start publishing bugs for third-parties in that window where patch Tuesday isn’t released yet. I just want to live like a normal human being for once in my life, is that too much to ask for…?\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Sep 03, 2026Vulnerability \/ Endpoint Security The security researcher known as Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has dropped a new zero-day dubbed FalconFlank, a privilege escalation…<\/p>\n","protected":false},"author":1,"featured_media":2667,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[3280,306,3281,3278,1730,305,1739,1824,3279],"class_list":["post-2666","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-crowdstrike","tag-escalation","tag-falcon","tag-falconflank","tag-poc","tag-privilege","tag-releases","tag-researcher","tag-showing"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2666","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2666"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2666\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2667"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}