Security researcher finds zero-day in CrowdStrike Falcon
Microsoft-focused researcher now targets other security products
1Researcher's new target
Security researcher known as Nightmare Eclipse, previously focused on Microsoft vulnerabilities, has discovered a new zero-day called 'FalconFlank' in CrowdStrike's Falcon endpoint security platform. The exploit abuses the platform's Microsoft Office macro remediation feature to enable privilege escalation. CrowdStrike advised customers to temporarily disable the suspicious macro removal feature while investigating.
2Technical details of the flaw
The FalconFlank vulnerability works on fully updated Windows 11 25H2 and Windows Server 2025 systems running CrowdStrike Falcon with 'Phase 3 - Optimal Protection' and malicious macro removal enabled. The researcher published proof-of-concept exploit code on GitHub but warned that CrowdStrike likely already has detection mechanisms in place, requiring testers to obfuscate the PoC.
3Industry reactions
Security expert Kevin Beaumont confirmed the exploit works and said Nightmare's recent discoveries highlight quality issues across endpoint security products. Beaumont hopes these findings will push cybersecurity vendors to focus on actual product security rather than hypothetical AI threats, forcing the industry to improve its game.
4Other security product vulnerabilities
Nightmare recently found 'HardBreacher', a privilege escalation bug in Kaspersky's endpoint antivirus, and 'PrettyPrague' in Gen Digital's Avast software - both working on fully patched systems. While Avast's parent company is developing a patch, Kaspersky hasn't yet commented. These discoveries show the researcher's expanding focus beyond Microsoft products.
5Nvidia vulnerability found
The researcher also disclosed 'GreenSection', a memory corruption vulnerability in Nvidia products, though this one merely crashes systems and isn't considered as critical. Nvidia hasn't responded to inquiries. These developments demonstrate how security researchers are now targeting the entire industry rather than single vendors.
6Broader industry problem
As Beaumont noted, endpoint security products' own security has become questionable. There's growing emphasis on strengthening fundamental security features rather than focusing on AI marketing hype. Nightmare's findings reveal these products aren't providing the protection they promise, raising concerns about their effectiveness.
7Company responses
CrowdStrike directed customers to its support portal for the FalconFlank Tech Alert, maintaining cloud anti-malware protection remains effective. Gen Digital announced it's developing a patch for the Avast vulnerability. However, Kaspersky and Nvidia's silence raises transparency concerns, potentially damaging customer trust in their security products.
8Warning for the industry
These incidents highlight the cybersecurity industry's need to secure its own products. The vulnerabilities discovered by researchers expose weaknesses across major security providers, not just Microsoft. To maintain customer confidence, companies must prioritize fundamental security measures over marketing claims about advanced capabilities.