Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon

Security researcher Chaotic Eclipse has released a proof-of-concept exploit named FalconFlank, which targets a zero-day privilege escalation vulnerability in the Crowdstrike Falcon Sensor. The flaw enables attackers to escalate privileges by abusing the sensor’s office malicious macros remediation mechanism on fully patched systems, including Windows 11 25H2 and Windows Server 2025. This disclosure follows recent releases by the same researcher demonstrating similar vulnerabilities in Kaspersky and Microsoft Defender products.