Detections
Analytics
CrowdStrike Falcon Sensor Local Privilege Escalation (CVE-2026-40058 / FalconFlank)
high Nessus Plugin ID 350271
Synopsis
A security product installed on the remote Windows host is affected by a local privilege escalation vulnerability.Description
The CrowdStrike Falcon Sensor installed on the remote Windows host is affected by a local privilege escalation vulnerability when the 'Microsoft Office file malicious macro removal' remediation feature is enabled (Phase 3 Optimal Protection policy or higher).An authenticated local attacker can exploit this by:
- Writing an OLE Compound Document (macro-bait file) into a staging directory under %TEMP% to trigger Falcon's SYSTEM-level macro remediation.
- Using an oplock to time a TOCTOU race window, deleting the staging v1.0 subdirectory, and planting an NTFS mount point (IO_REPARSE_TAG_MOUNT_POINT) that redirects any pending file operations to C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\.
- Delivering an arbitrary DLL payload via Transacted NTFS (TXFS / CreateFileTransacted), which commits an atomic overwrite of C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcrypt.dll while bypassing Falcon's minifilter write interception.
- Triggering SYSTEM-level DLL execution via the MareBackup scheduled task under \\Microsoft\\Windows\\Application Experience, which loads the replaced bcrypt.dll.
The result is full SYSTEM-level code execution from a standard user account.
Note that Nessus has not tested for this issue but has instead relied on detection of the vulnerable software being present.
The policy state of the 'Microsoft Office file malicious macro removal' feature could not be confirmed remotely; findings should be verified against the Falcon policy console.
Solution
Upgrade to the hotfixed build mentioned in the vendor's advisory.See Also
https://github.com/MSNightmare/FalconFlank
https://www.crowdstrike.com/en-us/security-advisories/cve-2026-40058/
Plugin Details
Severity: High
ID: 350271
File Name: crowdstrike_falcon_falconflank_privesc.nbin
Version: 1.1
Type: Local
Agent: windows
Family: Windows
Published: 9/25/2026
Updated: 9/25/2026
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 93.38
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2026-40058
CVSS v3
Risk Factor: High
Base Score: 8.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability Information
CPE: cpe:/a:crowdstrike:falcon_sensor
Required KB Items: SMB/Registry/Enumerated, installed_sw/CrowdStrike Falcon Sensor
Vulnerability Publication Date: 9/2/2026
Reference Information
CVE: CVE-2026-40058