InfoSecBulletin Cybersecurity for mankind
An unnamed security expert known as “Nightmare Eclipse” shared a CrowdStrike Falcon zero-day exploit called “FalconFlank.” This tool allows hackers to gain higher access on current Windows systems.
Nightmare Eclipse reports that the new weakness, still without a CVE ID, impacts devices using the latest Windows 11 and Windows Server versions, along with CrowdStrike’s security platform.
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Successful exploitation allows attackers to spawn a command prompt with SYSTEM privileges by abusing CrowdStrike Falcon’s Office malicious macros remediation feature.
“FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon Sensor, obviously by the time I drop this Crowdstrike would already have detections for it so if you want to test you either have to add it to the exclusions or obfuscate the PoC and change the dll load technique,”
Nightmare Eclipse said . “As of now it works in a fully updated windows 11 25H2 / Windows Server 2025 with Crowdstrike Falcon.”
Crowdstrike spokesperson said, “We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting.” “Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. We refer customers to the FalconFlank Tech Alert in the CrowdStrike support portal.”
Although the company also shared this link to the tech alert regarding the FalconFlank zero-day exploit, the advisory is not public, and customers can access it only if they have an account on CrowdStrike’s support portal.
Kaspersky, Avast, Nvidia, and Microsoft zero-days
This week, Nightmare Eclipse also shared zero-day exploits that let users gain extra control over Kaspersky Antivirus for Endpoint (called HardBreacher) and GenDigital Avast Antivirus (called PrettyPrague). They also released a zero-day for Nvidia (called GreenSection) that will crash the system.
Cybersecurity expert Kevin Beaumont confirmed on Thursday that the privilege escalation exploits released by Nightmare Eclipse this week are real and work.
Nightmare Eclipse has also disclosed multiple zero-day exploits targeting multiple Microsoft products since April, including Microsoft Defender, BitLocker, and various other Windows components.
These Microsoft zero-days are known as LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend. While the LegacyHive, RoguePlanet, YellowKey, GreenPlasma, and MiniPlasma flaws have since been fixed, the other security flaws remain zero-days and are still awaiting an official patch.
After Nightmare Eclipse disclosed the first zero-days, Microsoft responded with warnings of legal action against people engaging in “malicious activity causing real harm to our customers,” prompting many to believe that the company was directly threatening the security researcher.
Related Topic:
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
CrowdStrike publish Root Cause of Global System Outages
