CrowdStrike Falcon Sensor privilege escalation zero-day FalconFlank privilege-escalation flaw
Vulnerability
Summary
Hide ▲
Show ▼
FalconFlank is a zero-day privilege escalation in CrowdStrike Falcon Sensor that can elevate an attacker to SYSTEM on fully updated Windows 11 25H2 and Windows Server 2025 systems. The flaw abuses the sensor’s Office malicious macros remediation feature, turning a defensive control into a local escalation path, and the public disclosure includes a working proof of concept. The researcher using the handle Nightmare Eclipse released the details on GitHub on September 3, and Kevin Beaumont said the exploit works. CrowdStrike said it is actively investigating and advised customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting while it reviews the issue, while keeping Cloud Anti-malware for Microsoft Office Files enabled and referring customers to its FalconFlank Tech Alert.
Related Happenings
Steam discussion forums ClickFix campaign deploying XMRig miners
Campaign
H score34
First: 26.07.2026 01:37
Last: 26.07.2026 01:37
Sources 1
About this happening:
An ongoing ClickFix campaign on Steam discussion forums is tricking users into running PowerShell commands that install XMRig cryptominers. The operation abuses he...
Steam discussion forums ClickFix campaign deploying XMRig miners
CampaignAbout this happening: An ongoing ClickFix campaign on Steam discussion forums is tricking users into running PowerShell commands that install XMRig cryptominers. The operation abuses he...
KongTuke ClickFix and Teams access-seeking campaign
Campaign
H score33
First: 25.06.2026 11:54
Last: 25.06.2026 11:54
Sources 1
About this happening:
The KongTuke/Woodgnat campaign now includes Node.js/node.exe abuse to run attacker JavaScript and deploy payloads in targeted attacks against government departments*...
KongTuke ClickFix and Teams access-seeking campaign
CampaignAbout this happening: The KongTuke/Woodgnat campaign now includes Node.js/node.exe abuse to run attacker JavaScript and deploy payloads in targeted attacks against government departments*...
Latest development: 03.09.2026 13:43
KongTuke/Woodgnat actors have abused the signed Node.js/node.exe runtime to run attacker JavaScript and deploy malicious payloads in targeted attacks against government departments, technology companies, and hotels since February 2026. One intrusion against an unspecified Asian technology company between March 23 and July 25, 2026 used the official Node.js installer from nodejs[.]org and EtherHiding to establish long-term access, and related attack chains also involve CrashFix, ModeloRAT, Mistic, GateKeeper, C2Looper, and AsukaStealer.
Windows Collaborative Translation Framework CTFMON improper link resolution EoP security flaw (CVE-2026-45586)
Vulnerability
H score20
First: 09.06.2026 20:57
Last: 09.06.2026 20:57
Sources 1
About this happening:
Windows Collaborative Translation Framework (CTFMON) has a local privilege-escalation vulnerability, CVE-2026-45586, that Microsoft patched in June 2026. An author...
Windows Collaborative Translation Framework CTFMON improper link resolution EoP security flaw (CVE-2026-45586)
VulnerabilityAbout this happening: Windows Collaborative Translation Framework (CTFMON) has a local privilege-escalation vulnerability, CVE-2026-45586, that Microsoft patched in June 2026. An author...
Atlas RAT and related loaders deployed for remote access and credential theft
Malware Activity
H score33
First: 04.06.2026 00:45
Last: 04.06.2026 00:45
Sources 1
About this happening:
TA4922, a China-linked and likely financially motivated malware activity, has expanded beyond East Asia into Europe and Africa. The group uses Atlas RAT*...
Atlas RAT and related loaders deployed for remote access and credential theft
Malware ActivityAbout this happening: TA4922, a China-linked and likely financially motivated malware activity, has expanded beyond East Asia into Europe and Africa. The group uses Atlas RAT*...
Microsoft SharePoint remote code execution (CVE-2026-45659)
Vulnerability
H score17
First: 26.05.2026 14:49
Last: 26.05.2026 14:49
Sources 1
About this happening:
CVE-2026-45659 is a Microsoft SharePoint remote code execution vulnerability that affects unpatched SharePoint servers and can be triggered through deserializati...
Microsoft SharePoint remote code execution (CVE-2026-45659)
VulnerabilityAbout this happening: CVE-2026-45659 is a Microsoft SharePoint remote code execution vulnerability that affects unpatched SharePoint servers and can be triggered through deserializati...
Timeline
-
04.09.2026 16:22 4 articles · 13d ago
Nightmare Eclipse releases FalconFlank zero-day for CrowdStrike Falcon
Initial DisclosureAn anonymous researcher using the Nightmare Eclipse handle publicly released FalconFlank, a CrowdStrike Falcon zero-day that can escalate privileges to SYSTEM on up-to-date Windows 11 and Windows Server systems by abusing Falcon Sensor's Office malicious macros remediation feature; the researcher said it works on fully updated Windows 11 25H2 and Windows Server 2025, and CrowdStrike said it is actively investigating the claims while advising customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting and pointing customers to a FalconFlank Tech Alert in its support portal.
Show sources
- New CrowdStrike 'FalconFlank' zero-day grants SYSTEM privileges — www.bleepingcomputer.com — 04.09.2026 16:22
- New CrowdStrike 'FalconFlank' zero-day grants SYSTEM privileges — www.bleepingcomputer.com — 04.09.2026 16:22
- Researcher Publishes CrowdStrike Privilege Escalation Zero Day — www.infosecurity-magazine.com — 07.09.2026 11:28
- Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits — www.securityweek.com — 07.09.2026 15:15