CrowdStrike Falcon Hit by Zero-Day Vulnerability Exploit

A prolific Microsoft 0-day hunter has moved on from their singular focus on the tech giant and is now targeting other vendors, including CrowdStrike. The researcher, known as Nightmare Eclipse, released a proof-of-concept exploit for a privilege escalation vulnerability in CrowdStrike's Falcon endpoint security platform called FalconFlank.

The vulnerability, which affects Windows 11 and Windows Server 2025 systems running the latest version of CrowdStrike Falcon with Phase 3 - Optimal Protection enabled, takes advantage of the Microsoft Office malicious macros remediation feature. This feature inspects Microsoft Office documents for potentially harmful macros and strips them if found.

CrowdStrike has acknowledged the issue and is advising customers to disable a specific Windows policy setting related to the feature. The company's spokesperson stated that customers remain protected through other settings, such as Cloud Anti-malware for Microsoft Office Files. CrowdStrike also provided a link to a support portal with more information on the FalconFlank vulnerability.