Researcher Releases Zero-Day EDR Exploits Targeting CrowdStrike, Defender, and Avast
Security researcher Chaotic Eclipse has published a zero-day exploit named FalconFlank targeting CrowdStrike Falcon Sensor. The exploit demonstrates local privilege escalation by abusing the sensor's malicious macro remediation mechanism on fully updated Windows 11 25H2 and Windows Server 2025 systems. CrowdStrike confirmed it is investigating the issue and advised administrators to disable the specific Microsoft Office macro removal policy while relying on cloud protection features instead. This disclosure follows a string of similar privilege escalation releases by the same researcher targeting multiple endpoint security solutions. Prior to FalconFlank, the researcher dropped HardBreacher, a flaw in Kaspersky Endpoint Security for Windows that targets UI process control and drops an arbitrary DLL into `C:\Windows\System32\` with full user permissions. Kaspersky addressed the issue via automatic database updates shortly after public release. Another exploit, ShieldBreak (CVE-2026-69414), bypasses an earlier Microsoft Defender fix for CVE-2026-50656 by chaining Cloud Files API interactions, NT Object Manager namespace manipulation, and timing races during remediation to write `C:\Windows\System32\phoneinfo.dll` before obtaining `NT AUTHORITY\SYSTEM` execution via Windows Error Reporting. Additional public releases include PrettyPrague, which abuses Avast's sandbox to dump the SAM database and trigger a SYSTEM shell, and GreenSection, an NVIDIA memory corruption flaw crashing Vulkan and OpenGL applications. Gen Digital acknowledged the Avast vulnerability across related product lines and is currently developing a patch.
Read more about Researcher Releases Zero-Day EDR Exploits Targeting CrowdStrike, Defender, and Avast