Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC

As cited

Copy frozen at 2026-09-07 01:28 UTC (site build).

vulnerabilities

Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC

Researcher Nightmare Eclipse disclosed a privilege escalation vulnerability called FalconFlank in CrowdStrike Falcon that abuses the platform's malicious macro remediation feature for Microsoft Office documents. The researcher also published proof-of-concept exploits for privilege escalation bugs in Kaspersky Endpoint (HardBreacher), Avast Antivirus (PrettyPrague), and an Nvidia memory corruption flaw (GreenSection), marking a shift from their previous focus on Microsoft vulnerabilities. CrowdStrike and Gen Digital confirmed they are investigating and developing patches, while Kaspersky released a fix via automatic update.

Why it matters: Organizations running CrowdStrike Falcon with the Microsoft Office macro removal feature enabled need to disable that specific Windows policy setting immediately or add the PoC to exclusions to avoid privilege escalation attacks; security teams using Kaspersky Endpoint, Avast Antivirus, or Nvidia products should patch or apply mitigations as vendors release fixes for these elevation of privilege and memory corruption vulnerabilities.

Source published

2026-09-03 18:08 UTC

First seen by Cybersecurity Tracker

2026-09-07 00:35 UTC