{"id":11996,"date":"2026-09-03T11:02:28","date_gmt":"2026-09-03T17:02:28","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-95-0-day-privilege-escalation-via-abuse-of-ms-office-macros-remediation-in-crowdstrike-falcon\/"},"modified":"2026-09-29T13:01:39","modified_gmt":"2026-09-29T19:01:39","slug":"alert-2026-95-0-day-privilege-escalation-via-abuse-of-ms-office-macros-remediation-in-crowdstrike-falcon","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-95-0-day-privilege-escalation-via-abuse-of-ms-office-macros-remediation-in-crowdstrike-falcon\/","title":{"rendered":"Alert 2026-95 0-Day Privilege Escalation via Abuse of MS Office Macros Remediation in Crowdstrike Falcon"},"content":{"rendered":"\n

Affected product(s):<\/h2>\n\n

CrowdStrike Falcon Sensor \u2014 Endpoint security platform (EDR)<\/strong><\/p>\n\n

Product<\/strong><\/td>Vulnerable configuration<\/strong><\/td>Operating system<\/strong><\/td><\/tr>
CrowdStrike Falcon Sensor<\/strong><\/td>Phase 3 \u2014 Optimal Protection with “Microsoft Office file malicious macro removal” enabled<\/td>Windows 11 25H2 (fully updated)<\/td><\/tr>
CrowdStrike Falcon Sensor<\/strong><\/td>Phase 3 \u2014 Optimal Protection with “Microsoft Office file malicious macro removal” enabled<\/td>Windows Server 2025 (fully updated)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Description<\/h2>\n\n

A possible 0-day local privilege escalation (LPE)<\/strong> vulnerability affecting the CrowdStrike Falcon Sensor<\/strong> has been reported, and the source code and compiled binary of the exploit \u2014 dubbed FalconFlank<\/strong> \u2014 have been published. <\/strong>There is still no official statement from Crowdstrike.<\/p>\n\n

The flaw abuses the remediation mechanism of malicious macros in Microsoft Office files<\/strong> \u2014 a feature that operates with elevated privileges within the sensor \u2014 to escalate the privileges of an unprivileged local user to SYSTEM<\/strong> level on fully updated Windows systems.<\/p>\n\n

\"\"<\/figure>\n\n

Figure 1 FalconFlank exploitation flow<\/p>\n\n

The researcher stated that the proof of concept worked in fully updated Windows 11 25H2 and Windows Server 2025<\/a> environments protected by CrowdStrike Falcon with Phase 3 optimal protection enabled.<\/p>\n\n

The public repository was recently created and includes C source code, a Visual Studio solution, project files, header files, and a release directory compiled for x64.<\/p>\n\n

\"\"<\/figure>\n\n

Figure 2 – Evidence of the PoC published by the researcher.<\/p>\n\n

CrowdStrike has already issued a statement reporting that it is investigating the matter and recommends temporarily disabling the feature. When doing so, malicious macros will no longer be replaced automatically, but protection will continue to function normally through Cloud Anti-malware for Microsoft Office Files, provided that policies are configured according to best practices.<\/p>\n\n

Additionally, the exploit is already detected by Crowdstrike; however, an attacker may be able to evade that detection, so it is essential to apply mitigation until a patch for the vulnerability is available.<\/p>\n\n

\u00a0<\/h2>\n\n

Mitigation<\/h2>\n\n

While CrowdStrike issues an official patch:<\/p>\n\n