Your CrowdStrike agent just became the attack surface. FalconFlank is the third EDR zero-day in 5 weeks.

A researcher dropped a working privilege escalation exploit for CrowdStrike Falcon on GitHub. No advance notice. No coordinated disclosure.

The exploit abuses the Office malicious macros remediation feature built into the Falcon sensor itself.

Works on fully updated Windows 11 25H2 and Server 2025. No missing patch. This is a zero-day in the security tool, not the OS.

This is the third endpoint security zero-day from the same researcher in five weeks.

Kaspersky Endpoint Security. Microsoft Defender. Now CrowdStrike Falcon. The pattern is identical each time: abuse the AV/EDR remediation path intended to clean malicious files and turn it into a local privilege escalation vector.

The security tool designed to protect you is now the primitive attackers use to escalate to SYSTEM.

CrowdStrike is investigating and advising customers to disable the Microsoft Office File Suspicious Macro Removal policy setting. They say Cloud Anti-malware for Microsoft Office Files settings remain protective.

Audit your EDR policy configuration today. The attack vector is not a vulnerability in Windows. It is a feature in your security agent. Every endpoint running CrowdStrike, Kaspersky, or Microsoft Defender is in scope. If your CISO has not reviewed the FalconFlank Tech Alert in the CrowdStrike support portal, escalate this now.

SOURCE: https://thehackernews.com/2026/09/researcher-releases-falconflank-poc.html
VERIFIED: The Hacker News, SecurityAffairs, threat.wiki
SIGNAL: Enterprise security agents are now the attack surface. Three major EDR vendors compromised via the same abuse pattern in 5 weeks. Every CISO running these products needs to review policy configuration immediately.