New CrowdStrike 'FalconFlank' zero-day grants SYSTEM privileges

The FalconFlank zero-day exploit targets CrowdStrike Falcon's Office malicious macros remediation feature on fully updated Windows 11 25H2 and Windows Server 2025 systems. It allows attackers to escalate privileges to SYSTEM by abusing this feature. The vulnerability affects CrowdStrike's endpoint security platform and is unpatched at the time of reporting. CrowdStrike recommends disabling the Microsoft Office File Suspicious Macro Removal Windows policy setting to mitigate risk. The company is actively investigating the issue and has not yet publicly released a patch or assigned a CVE identifier.

Successful exploitation grants attackers SYSTEM-level privileges on affected Windows systems running CrowdStrike Falcon Sensor, potentially allowing full control over the endpoint. This elevates the attacker's capabilities significantly beyond standard user privileges. The vulnerability affects fully updated Windows 11 and Windows Server versions with CrowdStrike Falcon installed. No public evidence of active exploitation in the wild is reported at this time.

CrowdStrike advises customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting to mitigate this vulnerability. Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. CrowdStrike is actively investigating and has not yet released an official patch. Users should monitor CrowdStrike's support portal for the FalconFlank technical alert and any forthcoming updates. Avoid relying on detections alone, as the exploit author notes that obfuscation may bypass current detections.