---
id: 7523
title: "FalconFlank: CrowdStrike Falcon Sensor 0-Day Local Privilege Escalation Exploit"
severity: high
vendor: "CrowdStrike"
product: "Falcon Sensor"
affected_versions: "Windows 11 25H2 / Windows Server 2025"
source_domain: github.com
source_url: "https://github.com/MSNightmare/FalconFlank"
published_at: "2026-09-03T02:48:22Z"
tags: ["zero-day", "privilege-escalation", "windows", "red-team", "poc", "0day", "crowdstrike", "falcon"]
phying_url: "https://phying.com/item/7523"
lang: en
---

# FalconFlank: CrowdStrike Falcon Sensor 0-Day Local Privilege Escalation Exploit

## Summary

FalconFlank: a PoC 0-day in CrowdStrike Falcon Sensor on Windows 11 25H2 / Server 2025 that abuses the Office malicious-macro remediation routine to hijack execution and escalate to SYSTEM.

## Why it matters

Highlights security risks in privileged EDR automated remediation workflows, showing how defensive agent cleanups can be weaponized for local privilege escalation through filesystem reparse points.

## Intelligence Metadata

- **Sources:** github.com
- **Vendor:** CrowdStrike
- **Product:** Falcon Sensor
- **Affected versions:** Windows 11 25H2 / Windows Server 2025
- **Published:** 2026-09-03T02:48:22Z
- **Original:** https://github.com/MSNightmare/FalconFlank
- **Phying News:** https://phying.com/item/7523