Full Report
The security researcher known as Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has dropped a new zero-day dubbed FalconFlank, a privilege escalation flaw impacting Crowdstrike Falcon. "FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in CrowdStrike Falcon Sensor," the researcher said in a GitHub README file, adding
Analysis Summary
# Morning News Roll-up September 03, 2026
## Overview
A security researcher has publicly released Proof-of-Concept (PoC) code for multiple zero-day privilege escalation vulnerabilities affecting major endpoint security products, including CrowdStrike Falcon, Kaspersky, and Microsoft Defender.
## Top Stories
### Researcher Releases FalconFlank PoC for CrowdStrike Falcon
- Summary: A researcher known as Chaotic Eclipse has disclosed "FalconFlank," a zero-day local privilege escalation flaw that abuses the malicious macro remediation process within the CrowdStrike Falcon Sensor.
- Source: hxxps://thehackernews[.]com/2026/09/researcher-releases-falconflank-poc.html
### HardBreacher Exploit Targets Kaspersky Endpoint Security
- Summary: The same researcher released a PoC for a privilege escalation flaw in Kaspersky Endpoint Security for Windows (v14.0.0.504), allowing attackers to gain control over UI processes and manipulate file access permissions.
- Source: hxxps://github[.]com/MSNightmare/HardBreacher
### ShieldBreak Zero-Day Impacts Microsoft Defender
- Summary: A local privilege escalation vulnerability dubbed ShieldBreak (CVE-2026-69414) allows attackers to run arbitrary code with SYSTEM privileges by redirecting Defender's remediation engine to write malicious DLLs to protected directories.
- Source: hxxps://thehackernews[.]com/2026/08/shieldbreak-zero-day-poc-claims.html
---
# FalconFlank Privilege Escalation
FalconFlank is a zero-day local privilege escalation (LPE) vulnerability targeting the CrowdStrike Falcon Sensor. It leverages flaws in how the security software handles the remediation of malicious Office macros to gain elevated permissions on a host system.
## Key Points
- The flaw specifically abuses the **office malicious macros remediation** logic within the sensor.
- The exploit allows a low-privileged user to escalate privileges on a target system.
- The PoC has been verified to work on fully updated versions of **Windows 11 25H2** and **Windows Server 2025**.
- Success of the exploit may require the attacker to obfuscate the PoC or change DLL loading techniques to bypass current CrowdStrike detections.
## Threat Actors
- **Chaotic Eclipse**: Also known by aliases **INFINITE NIGHTMARE**, **MSNightmare**, and **Nightmare-Eclipse**.
- **Motivations**: The researcher claims to release these vulnerabilities due to frustrations with vendor bug reporting restrictions and a lack of engagement from major software providers (specifically citing Microsoft).
## TTPs
- **Privilege Escalation**: Gaining higher-level access (SYSTEM/Admin) from a low-privileged state.
- **Remediation Abuse**: Exploiting the security software's own cleanup or quarantine mechanisms to perform unauthorized actions.
- **DLL Sideloading/Injection**: The researcher mentions changing "DLL load techniques" as a way to ensure the PoC remains functional against detections.
- **Timing Races**: Similar to the related "ShieldBreak" exploit, these flaws often involve timing races in the remediation path to redirect file writes.
## Affected Systems
- **CrowdStrike Falcon Sensor**: Specific versions not listed, but confirmed working on current deployments.
- **Operating Systems**:
- Windows 11 25H2 (Fully updated)
- Windows Server 2025
- **Other Impacted Vendors**: Similar vulnerabilities (HardBreacher and ShieldBreak) have been released for Kaspersky Endpoint Security (v14.0.0.504) and Microsoft Defender.
## Mitigations
- **Exclusion Review**: Ensure that sensitive directories (like System32) are strictly monitored for new, unexpected DLL files.
- **Detection Updates**: Organizations should ensure their Falcon Sensor versions are up-to-date, as CrowdStrike is suspected to be developing/releasing detections for the PoC.
- **Obfuscation Monitoring**: Monitor for obfuscated scripts or unusual DLL loading activities that may be attempting to bypass EDR self-protection.
- **Alternative Mitigations**: For the related ShieldBreak flaw, Qualys recommends monitoring the Cloud Files API and Object Manager namespace manipulation.
## Conclusion
The release of FalconFlank highlights a growing trend of "remediation abuse," where the very tools meant to secure a system are weaponized to compromise it. Because the PoC is public, the risk of exploitation by opportunistic threat actors is high. Administrators should prioritize monitoring for unauthorized DLL creation in system directories and stay appraised of official patches from CrowdStrike and Microsoft.