CuraSec

tag: Crowdstrike · 2 items

Act archived CrowdStrike Falcon 'FalconFlank' zero-day enables SYSTEM privilege escalation
2026-09-04 · BleepingComputer · source ↗ #privilege-escalation#crowdstrike#zero-day
  • Engineer — Act: A public exploit targeting CrowdStrike Falcon on fully-patched Windows exists with no vendor patch yet; monitor CrowdStrike’s advisory channel closely and apply the patch immediately upon release — consider whether compensating controls (network segmentation, application allow-listing) can reduce local-access risk in the interim.
  • SOC/IR — Act: The exploit abuses CrowdStrike Falcon’s highly-privileged agent process to reach SYSTEM; hunt for anomalous SYSTEM-level child processes or handle manipulation originating from Falcon services, and flag any detections for IR escalation until a patch ships.
  • Leader — Plan: A public zero-day against your likely-deployed EDR vendor has no patch yet; engage your CrowdStrike account team for an official advisory timeline and prepare a leadership brief in case active exploitation is confirmed before a fix is released.
Act archived FalconFlank 0day PoC: Privilege Escalation in CrowdStrike Falcon Sensor
2026-09-03 · The Hacker News · source ↗ #crowdstrike#privilege-escalation#zero-day
  • Engineer — Act: A public PoC now exists for a 0day privilege escalation in CrowdStrike Falcon Sensor — a highly privileged process running on every protected endpoint. Monitor CrowdStrike’s advisory channel for an emergency patch and audit endpoint telemetry for local privilege escalation events involving Falcon processes.
  • SOC/IR — Act: With a public PoC available, this turns your own EDR agent into an attack vector; begin hunting for macro remediation abuse and anomalous privilege escalation events in Falcon telemetry from the PoC release date forward, and alert on-call that detections from Falcon on affected hosts may be less trustworthy until patched.
  • Leader — Plan: If CrowdStrike Falcon is in your endpoint stack, contact your TAM this week to obtain an official vendor advisory and expected patch timeline; consider whether the risk warrants a brief to engineering leadership given that the security tooling itself is the attack surface.