CrowdStrike is investigating a claimed privilege escalation vulnerability in its Falcon Sensor and is advising customers to disable a specific Microsoft Office macro policy setting while the review continues, the company told Security Point Break.
“We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting,” a CrowdStrike spokesperson said in a statement provided to Security Point Break. “Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. We refer customers to the FalconFlank Tech Alert in the CrowdStrike support portal.”
The claim originated with a security researcher who has operated under the aliases Nightmare-Eclipse, Chaotic Eclipse and most recently MSNightmare. The researcher published a proof of concept on GitHub Wednesday night, naming the project FalconFlank.
According to the researcher’s own description, the technique abuses how Falcon Sensor remediates Windows systems after detecting a malicious Microsoft Office macro, granting local attackers SYSTEM-level access on fully updated Windows 11 25H2 and Windows Server 2025 machines running Falcon with Phase 3 Optimal Protection enabled.
CrowdStrike has published a Tech Alert on the issue in its support portal (login required) but had not assigned a public CVE as of publication. Security Point Break is not linking to the proof-of-concept repository.
The researcher, who has operated first as Nightmare-Eclipse and later under new GitHub handles after account takedowns, published at least eight Windows and Defender zero-days between April and August. Those releases include RoguePlanet, a Defender privilege escalation bug Microsoft assigned CVE-2026-50656 and patched in July.
A subsequent bypass called ShieldBreak undid that fix in August, according to Arctic Wolf. Krebs on Security and The Register have reported the researcher is a former Microsoft security employee. The campaign, according to that reporting, began after a dispute over vulnerability handling and bounty payments.
Falcon Sensor runs with extensive OS-level privileges to monitor endpoints, and a confirmed local privilege escalation bug in an EDR agent would affect any organization running the product with macro remediation enabled.
CrowdStrike’s guidance gives administrators an immediate step: disable the Suspicious Macro Removal Windows policy setting, confirm Cloud Anti-malware for Microsoft Office Files remains active, and consult the FalconFlank Tech Alert in the support portal for further detail.
Security Point Break will update this story as CrowdStrike’s investigation progresses.
