Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon

The security researcher known as Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has dropped a new zero-day dubbed FalconFlank, a privilege escalation flaw impacting Crowdstrike Falcon. "FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in CrowdStrike Falcon Sensor," the researcher said in a GitHub README file, adding

Fact: A security researcher has released a FalconFlank proof-of-concept showing a zero‑day privilege escalation flaw in CrowdStrike Falcon Sensor, specifically abusing its office malicious macros remediation logic. Fact: This indicates that a widely deployed endpoint security product can be turned into a vector for gaining higher privileges, potentially undermining protections on systems where AI workloads or agents run. RealGround analysis: For organizations relying on CrowdStrike‑protected infrastructure to host or operate AI systems, this elevates supply chain risk because a trusted security control can be exploited as an attack path, making hardened configurations and rapid patching essential. RealGround analysis: Proactive AI supply chain review and continuous red teaming focusing on EDR/AV integrations with AI workloads can help identify similar privilege escalation paths before they are weaponized at scale.