Skip to content
FalconFlank: CrowdStrike Falcon Sensor 0-Day Local Privilege Escalation Exploit
github.com | vulnerability | High | #zero-day | #privilege-escalation | #windows | #red-team | #poc | #0day | #crowdstrike | #falcon
Summary
FalconFlank: a PoC 0-day in CrowdStrike Falcon Sensor on Windows 11 25H2 / Server 2025 that abuses the Office malicious-macro remediation routine to hijack execution and escalate to SYSTEM.
Why it matters
Highlights security risks in privileged EDR automated remediation workflows, showing how defensive agent cleanups can be weaponized for local privilege escalation through filesystem reparse points.
- Vendor
- CrowdStrike
- Product
- Falcon Sensor
- Affected versions
- Windows 11 25H2 / Windows Server 2025
- Published
- Collected