[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4dHIsj_Y5-1V_uS6llOtErJfzRljtqXyyvrJ8ssveBU":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"5553d568-8548-4620-8da4-99aa1302ad3a","New CrowdStrike 'FalconFlank' zero-day grants SYSTEM privileges","new-crowdstrike-falconflank-zero-day-grants-system-privileges-beea4d","An anonymous security researcher who uses the \"Nightmare Eclipse\" handle released a CrowdStrike Falcon zero-day exploit named \"FalconFlank\" that lets attackers escalate privileges on up-to-date Windows systems. [...]","A security researcher known as 'Nightmare Eclipse' has released a zero-day exploit named 'FalconFlank' that grants SYSTEM privileges on up-to-date Windows 11 and Windows Server systems running CrowdStrike Falcon. The exploit abuses a feature designed to remediate malicious Office macros. CrowdStrike is investigating and advises customers to disable a specific Windows policy setting.","CrowdStrike Falcon zero-day 'FalconFlank' allows SYSTEM privilege escalation on Windows.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-crowdstrike-falconflank-zero-day-grants-system-privileges\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F04\u002FCrowdStrike.jpg","2026-09-04T13:22:01+00:00","2026-09-04T14:00:26.092539+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"FalconFlank","product",{"name":21,"type":22},"CrowdStrike","vendor",{"name":24,"type":19},"CrowdStrike Falcon",{"name":26,"type":19},"Windows 11",{"name":28,"type":19},"Windows Server",{"name":30,"type":19},"Microsoft Defender","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":31,"icon":33,"name":34,"slug":35},null,"Zero-day","zero-day",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18,24],{"controls":57,"vendors":144},[58,86,115],{"slug":59,"name":60,"problem":61,"products":62},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[63,71,78],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":59,"product_name":75,"url":76,"description":77},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":87,"name":88,"problem":89,"products":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":116,"name":117,"problem":118,"products":119},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[145],{"slug":146,"name":21,"logo_path":147,"roles":148},"crowdstrike","\u002Fvendor-logos\u002Fcrowdstrike.png",[149],"affected",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":166},"crowdstrike-falcon-zero-day-grants-system-privileges-via-office-macro-feature-abuse","CrowdStrike Falcon Zero-Day Grants SYSTEM Privileges via Office Macro Feature Abuse","The 'FalconFlank' zero-day exposes a critical privilege escalation flaw in CrowdStrike Falcon, a tool organizations rely on for endpoint protection — demonstrating that even security software itself can become an attack surface. The exploit abuses a legitimate remediation feature designed to handle malicious Office macros, highlighting how trusted functionality can be weaponized when not properly constrained. This is particularly dangerous because the affected systems are fully up-to-date, meaning traditional patching alone cannot immediately protect users. It underscores the importance of defense-in-depth: no single security tool should be trusted implicitly without compensating controls. Organizations face a window of exposure where a publicly released exploit exists but no vendor patch is yet available.",[155,156,157,158,159,160,161,162,163,164,165],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 18: Penetration Testing","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AU-12: Audit Record Generation","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","NIST CSF RS.MI-3: Newly Identified Vulnerabilities Mitigated","MITRE ATT&CK T1068: Exploitation for Privilege Escalation","ISO 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]