Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC

{
  "signal_id": "6b926447-8787-afeb-7a8e-de6951fe5629",
  "signal_type": "news",
  "signal_subtype": "security_incident",
  "detected_at": "2026-09-03T18:08:22+00:00",
  "company": {
    "name": "CrowdStrike",
    "domain": "crowdstrike.com"
  },
  "data": {
    "url": "https://www.theregister.com/security/2026/09/03/prolific-microsoft-0-day-hunter-drops-crowdstrike-falcon-exploit-poc/5294318",
    "title": "Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC",
    "excerpt": "Security A shared security 'Nightmare' The disgruntled security researcher known as Nightmare Eclipse (aka Chaotic Eclipse, Infinite Nightmare, and now also MSNightmare) is moving away from their singular Microsoft vendetta and on to other vendors. On Thursday, they dropped a new zero-day bug called FalconFlank that affects CrowdStrike’s Falcon endpoint security platform - albeit with a Windows link. According to the prolific zero-day hunter , FalconFlank is a privilege escalation vulnerability that abuses the Microsoft Office malicious macros remediation feature in CrowdStrike Falcon. This is an automated security tool built into the platform that inspects Microsoft Office documents. If it finds any potentially harmful macros, the feature strips the suspect code and - hopefully - prevents malicious code or other dangerous payloads from executing when users open the document. “We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting,” a CrowdStrike spokesperson told The Register . “Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. We refer customers to the FalconFlank Tech Alert in the CrowdStrike support portal.” The proof-of-concept (PoC) exploit works on fully updated Windows 11 25H2 and Windows Server 2025 systems running CrowdStrike...",
    "product": "Falcon",
    "summary": "A security researcher disclosed a zero-day privilege escalation vulnerability, named FalconFlank, in CrowdStrike's Falcon endpoint security platform, which abuses the Microsoft Office malicious macros remediation feature.",
    "planning": false,
    "image_url": "https://image.theregister.com/5294333.jpg?imageId=5294333&x=0&y=0&cropw=100&croph=100&panox=0&panoy=0&panow=100&panoh=100&width=1200&height=683",
    "confidence": 0.9,
    "product_data": {
      "name": "Falcon",
      "full_text": "CrowdStrike’s Falcon endpoint security platform",
      "fuzzy_match": false
    },
    "product_tags": [
      "security",
      "general_technology"
    ],
    "published_at": "2026-09-03T18:08:22Z",
    "vulnerability": "FalconFlank privilege escalation vulnerability",
    "effective_date": "2026-09-03",
    "article_sentence": "On Thursday, they dropped a new zero-day bug called FalconFlank that affects CrowdStrike’s Falcon endpoint security platform - albeit with a Windows link.",
    "related_company_name": "Microsoft",
    "related_company_domain": "microsoft.com"
  }
}

curl https://signals.autobound.ai/v1/signals/6b926447-8787-afeb-7a8e-de6951fe5629 \
  -H "X-API-KEY: $AUTOBOUND_API_KEY"

curl -X POST https://signals.autobound.ai/v1/companies/enrich \
  -H "X-API-KEY: $AUTOBOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain":"crowdstrike.com","limit":20}'