CrowdStrike investigates Falcon privilege-escalation claim

A researcher who publishes as Nightmare-Eclipse (also Chaotic Eclipse and MSNightmare) released FalconFlank, a proof of concept that claims a local privilege-escalation path in CrowdStrike Falcon. Cyber Security News updated its report on 4 September 2026 with a CrowdStrike spokesperson. The Hacker News also covered the release. Public reporting has not assigned a CVE, and CrowdStrike has not published a patch.

The claimed path sits in Falcon's remediation workflow for malicious Microsoft Office macros, and only when that policy is turned on. The researcher says the PoC worked on fully updated Windows 11 25H2 and Windows Server 2025 with Falcon Phase 3 Optimal Protection enabled.

CrowdStrike said it is "actively investigating these claims" and gave operators a concrete mitigation: disable the Microsoft Office File Suspicious Macro Removal Windows policy setting. Customers, the company said, "remain protected through the Cloud Anti-malware for Microsoft Office Files settings." It pointed customers to the FalconFlank Tech Alert in the CrowdStrike support portal.

The named policy is the switch. Cloud Anti-malware for Microsoft Office Files is the path CrowdStrike says still covers the Office-file risk if the policy is turned off.

The privilege-escalation claim still needs validation. The shape is different from confirmed, in-the-wild appliance bugs such as SonicWall's SMA 1000 zero-days, which had vendor CVEs and fixes. FalconFlank, so far, has a PoC and a support-portal alert.

Some offers on this page may be paid placements or contain affiliate links.