FalconFlank: CrowdStrike Falcon Zero Day

On September 3, 2026, a researcher published FalconFlank, a working proof of concept that elevates a low privileged Windows user to SYSTEM by abusing a legitimate CrowdStrike Falcon sensor feature: its cleanup of malicious Office macros. No CVE has been assigned and no vendor advisory exists, and the exploit source is public, so the code can be rebuilt with its obvious fingerprints removed. The chain requires the Microsoft Office file malicious macro removal setting to be enabled in the Falcon prevention policy, and it requires nothing more than the ability to run code as an unprivileged local user. Vega reproduced the exploit in a controlled lab to establish which stages of the chain leave a record in endpoint telemetry.

Execution stays entirely inside directories the unprivileged user already controls, and never needs write access to the protected Windows system directory. The exploit builds a directory tree under the user temporary directory that mirrors the layout of the PowerShell installation directory, and writes a malicious copy of a system cryptography library into it. It then places an opportunistic lock on that library, so that any access by another process yields a short window of control. In that window the exploit removes the staged directory and substitutes an NTFS junction pointing at the genuine PowerShell installation directory.

With the junction in place, the exploit opens the genuine cryptography library through the redirected path, overwrites it, and commits the replacement as a single atomic NTFS transaction. The Falcon sensor installs a scheduled task that runs as SYSTEM, and the exploit triggers that task directly. The task loads the replaced library, and the attacker supplied code executes with SYSTEM privileges. A named pipe created by the exploit then serves as the command channel to the elevated code.