Zero-Days in CrowdStrike, Avast, Nvidia Disclosed
Researcher 'Nightmare Eclipse' Drops Three LPE Zero-Day Exploits
Related Entities(initial)
Threat Actors
Organizations
Products & Tech
Other
Full Report(when first published)
Executive Summary
A security researcher operating under the alias Nightmare Eclipse has publicly disclosed three separate zero-day local privilege escalation (LPE) vulnerabilities affecting widely deployed software from CrowdStrike, Avast, and Nvidia. The researcher released proof-of-concept (PoC) exploit code for all three flaws, named 'FalconFlank', 'PrettyPrague', and 'GreenSection'. Each vulnerability allows an attacker who has already achieved initial code execution on a target system to elevate their privileges to NT AUTHORITY\SYSTEM, granting them complete control. While Avast's parent company, GenDigital, claims to have patched its product, CrowdStrike has confirmed it is investigating and has provided interim mitigation guidance. These disclosures highlight the significant risk posed by vulnerabilities within security products themselves, which can be turned into powerful tools for attackers post-compromise.
Vulnerability Details
Three distinct LPE vulnerabilities were disclosed, each targeting a different product and leveraging a unique abuse mechanism.
FalconFlank (CrowdStrike Falcon Sensor): This vulnerability resides in the CrowdStrike Falcon Sensor for Windows. The exploit abuses the sensor's remediation feature designed to handle malicious Microsoft Office macros. An attacker with low-privilege code execution can manipulate this process to force the Falcon Sensor, which runs with SYSTEM privileges, to load a malicious DLL. This results in the attacker's code being executed with the highest level of privilege on the system. The flaw is confirmed to affect fully patched Windows 11 26H2 and Windows Server 2026 systems.
PrettyPrague (Avast Antivirus): This exploit targets the sandbox component of Avast Antivirus. The PoC demonstrates the ability to escape the sandbox and spawn a shell with full SYSTEM privileges. The vulnerability may also affect other products from parent company GenDigital, such as AVG and Norton.
GreenSection (Nvidia Components): This is an out-of-bounds memory write vulnerability affecting a shared global memory section used by multiple Nvidia user-mode components. An attacker can leverage this to write arbitrary data and escalate privileges.
Affected Systems
- CrowdStrike: Falcon Sensor for Windows running on Windows 11 (26H2) and Windows Server 2026. The specific sensor versions affected have not been publicly detailed by CrowdStrike.
- Avast: Avast Antivirus. Parent company GenDigital suggests potential impact on related products like AVG Antivirus and Norton security software.
- Nvidia: Multiple user-mode components. Specific affected drivers or software versions have not been detailed.
Exploitation Status
As of September 7, 2026, proof-of-concept (PoC) exploit code for all three vulnerabilities has been made public by the researcher. There are no public reports of these exploits being used in the wild by other threat actors. However, the public availability of working PoCs significantly increases the likelihood of their adoption and weaponization, especially 'FalconFlank', which targets a prominent EDR solution.
Impact Assessment
While these are local privilege escalation vulnerabilities and require an attacker to have already gained initial access, their impact is severe. Compromising a security product like an antivirus or EDR sensor is a high-value objective for attackers. By escalating to SYSTEM via the very tool meant to detect them, attackers can effectively neutralize the endpoint's defenses, blind the security team, and proceed with lateral movement, credential theft, and data exfiltration undetected. For organizations relying on CrowdStrike Falcon, an attacker could use 'FalconFlank' to bypass endpoint protection and achieve persistence, turning a minor intrusion into a full-blown compromise.
Cyber Observables — Hunting Hints
The following patterns may help identify systems where these exploits have been attempted or successfully executed:
csfalconservice.exeAvastSvc.execmd.exe, powershell.exe).4688 (Process Creation) showing suspicious processes spawned by security product services.C:\Windows\System32\Detection Methods
Detecting the exploitation of these LPEs requires deep system-level monitoring, as the malicious activity will be initiated by a trusted, highly privileged process.
- Behavioral Analysis: Configure EDR and SIEM systems to alert on unusual behavior from trusted security processes. For example,
csfalconservice.exeorAvastSvc.exespawningcmd.exe, loading unsigned DLLs from non-standard paths, or making outbound network connections are all highly suspicious activities. - DLL Load Monitoring: Use tools like Sysmon (Event ID 7) to monitor for suspicious DLLs being loaded by the Falcon Sensor service. An attacker using 'FalconFlank' would need to place a malicious DLL in a location where the service would load it.
- Command-Line Auditing: Enable process creation logging with command-line arguments (Event ID 4688). An attacker who has successfully escalated privileges will likely use
cmd.exeorpowershell.exeto execute further commands. The parent process for these shells would be the compromised security service.
Defensive techniques from the D3FEND framework, such as D3-PA (Process Analysis) and D3-SFA (System File Analysis), are crucial for identifying the anomalous process and file activities associated with this type of exploit.
Remediation Steps
Immediate remediation focuses on mitigation and patching where available.
- CrowdStrike 'FalconFlank' Mitigation: CrowdStrike has advised customers to disable the "Microsoft Office File Suspicious Macro Removal" policy setting within the Falcon console as an interim measure. This disables the vulnerable feature path. Customers should refer to the technical alert in the CrowdStrike support portal for the latest guidance.
- Avast 'PrettyPrague' Patch: GenDigital has stated the vulnerability has been fixed. Users of Avast, AVG, and Norton products should ensure their software is updated to the latest version. Auto-updates should handle this, but manual verification is recommended.
- Nvidia 'GreenSection' Patch: No specific patch has been announced. Users should monitor Nvidia's security bulletins and apply driver and software updates as they become available.
- Principle of Least Privilege: As these are LPE vulnerabilities, ensure that user accounts operate with the lowest possible privileges. This will not prevent the exploit if an attacker gains code execution as that user, but it limits their initial capabilities.
- Restrict Initial Access: The most effective long-term defense is to harden systems against initial access vectors like phishing, exploitation of public-facing applications, and credential abuse. An attacker cannot use an LPE if they cannot get on the box in the first place.
Timeline of Events
Article Updates
September 8, 2026
New technical analysis for 'FalconFlank' LPE in CrowdStrike Falcon Sensor, including MITRE ATT&CK techniques and specific hunting indicators.
This update provides a deeper technical analysis of the 'FalconFlank' local privilege escalation vulnerability affecting CrowdStrike Falcon Sensor. It details the exploit's mechanism, mapping it to MITRE ATT&CK techniques such as T1068 (Privilege Escalation) and T1548.002 (Bypass UAC). New hunting hints are included, focusing on monitoring CSFalconService.exe for unexpected DLL loads from non-standard paths, file writes to C:\Windows\Temp\, and unusual child processes (Event ID 4688). The interim mitigation remains disabling the 'Office malicious macros remediation' policy.
Timeline of Events
The researcher 'Nightmare Eclipse' publicly discloses PoC exploits for three LPE zero-day vulnerabilities.
CrowdStrike confirms it is investigating the 'FalconFlank' vulnerability and provides mitigation advice.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.