A researcher going by Chaotic Eclipse — also INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse — published a proof of concept on GitHub called FalconFlank, claiming a local privilege escalation in CrowdStrike Falcon Sensor.

Before anything else, here is the evidentiary position, because it is the story.

What is actually established

  • The PoC exists and is public.
  • The researcher says it abuses the Office malicious-macro remediation in Falcon Sensor, and says it works on a fully updated Windows 11 25H2 machine or Windows Server 2025.
  • That is the extent of the published mechanism. One sentence.

And here is what does not exist: no CVE, no CrowdStrike advisory, no patch, no affected-version list, and no public reproduction by anyone other than the author.

The claim is single-sourced to the person selling it as a finding. That is not an accusation — plenty of real vulnerabilities start exactly this way — but it is the correct label to put on it until someone else runs the code.

We are also not going to reconstruct the technique from a one-line description. There is nothing to reconstruct it from, and guessing at exploit mechanics is how "researcher claims" becomes "confirmed" without anybody doing any work.

The disclosure was a drop, not a report

There is no indication the researcher notified CrowdStrike before publishing. The stated reasoning is that the vendor "may already have detections for the flaw by now" — an assumption, offered in place of a notification.

The Hacker News says it contacted CrowdStrike for comment and had not received a response at publication.

So defenders currently have: working exploit code in public, no fix, and no vendor guidance. That is the worst configuration of those three variables, and it is a choice somebody made.

The workaround is evasion advice

The researcher's own suggestion for getting the PoC to run is to add it to the exclusions, or obfuscate it and change how the DLL is loaded.

Read that again as a security document. It is not mitigation. It is instruction on getting past the product — offered to the reader of a vulnerability disclosure, where a mitigation section normally goes.

That inversion is worth naming, because it settles what kind of publication this is. A disclosure written for defenders tells you how to detect or contain the thing. This one tells you how to make it work.

Exclusion lists keep showing up in that role. Users added them voluntarily to silence adware and got ValleyRAT; malware set them and locked the ACLs so nobody could remove them. Here they are the recommended setup step.

Why an EDR LPE matters if it is real

Take the claim at face value for a moment. Endpoint detection agents run with the highest privilege on the host by design — that is what lets them see everything. A local privilege escalation in the agent converts the most privileged process on the machine into the attacker's ladder, and it does it inside a process that security teams have specifically told their controls to trust.

That is the same structural problem as a signed driver being used to remove Defender at boot and Akira using Safe Mode to get out from under EDR: the defensive component is the highest-value target on the box precisely because it is the most trusted one.

Which is exactly why the claim deserves verification rather than amplification.

What to do

  • Do not change anything yet. There is no patch to apply and no configuration guidance from the vendor.
  • Watch for a CrowdStrike advisory. If this is real, that is where the affected versions and the fix will appear.
  • Do not add exclusions on the strength of a PoC's README. That is the one action this document actively encourages and the one you should not take.
  • Treat "researcher claims 0-day in security product" as unverified until a second party reproduces it, including when the product is one you do not use.

What is not established

  • Whether the vulnerability is real. Nobody outside the author has published a reproduction.
  • Which Falcon Sensor versions are affected, if any.
  • Whether CrowdStrike considers it a vulnerability. No statement has been issued.
  • Whether it is being exploited. No detections or incidents are reported.
  • Whether a CVE will be assigned. None exists at the time of writing.