CrowdStrike investigates Falcon privilege-escalation zero-day

CrowdStrike is investigating a reported zero-day exploit, dubbed FalconFlank, that can let an attacker obtain SYSTEM privileges on fully updated Windows 11 and Windows Server systems running its Falcon endpoint platform. The exploit is said to abuse Falcon's Office malicious-macros remediation feature. CrowdStrike advised customers to disable the related Microsoft Office File Suspicious Macro Removal policy while retaining Cloud Anti-malware for Microsoft Office Files settings. The flaw has no CVE identifier, but an independent security expert confirmed the released privilege-escalation exploits work.