The security researcher known under the alias MSNightmare (INFINITE NIGHTMARE) has published on GitHub a public PoC exploit called FalconFlank, claimed to be a privilege escalation vulnerability in the CrowdStrike Falcon Sensor. This is the researcher’s third publication in recent weeks: earlier, similar vulnerabilities were disclosed in Kaspersky Endpoint Security and Microsoft Defender. None of the three vulnerabilities affecting CrowdStrike and Kaspersky has been confirmed by the vendors, assigned a CVE identifier, or independently validated. Organizations using these products should monitor vendor updates and strengthen endpoint monitoring.
FalconFlank: claimed vulnerability in CrowdStrike Falcon
According to the description in the FalconFlank repository, the exploit abuses the Office malicious macro remediation mechanism in CrowdStrike Falcon Sensor to achieve privilege escalation. The researcher claims the PoC works on fully up-to-date Windows 11 25H2 and Windows Server 2025 systems with Phase 3 Optimal Protection enabled and the Microsoft Office malicious macro removal feature turned on.
It is important to stress: these claims come solely from the researcher-controlled repository. At the time of publication, no official response from CrowdStrike, CVE assignment, or independent reproduction of the vulnerability has been found. The exploitation status is classified as public PoC available—no confirmed cases of exploitation in real-world attacks have been recorded.
HardBreacher: Kaspersky Endpoint Security
A few days earlier, the same researcher released the HardBreacher PoC exploit, targeting Kaspersky Endpoint Security for Windows version 14.0.0.504. The author himself describes the PoC as unstable: the exploit may terminate with errors multiple times and requires repeated execution. If successful, according to the researcher, a DLL file is created in the C:\Windows\System32 directory with full rights for the current user, and the Kaspersky user interface process loses control over the operating system.
As with FalconFlank, HardBreacher has no CVE identifier, CVSS score, or any response from Kaspersky. All technical claims are based solely on the description in the researcher’s repository.
ShieldBreak: the most documented of the three vulnerabilities
Unlike the two previous disclosures, the ShieldBreak vulnerability in Microsoft Defender has a significantly stronger evidentiary basis. According to an analysis by Qualys, the public PoC was released on August 12, 2026, and on August 14 Microsoft assigned the identifier CVE-2026-69414 to the vulnerability.
Key technical characteristics of ShieldBreak:
- CVSS 3.1: 7.8 (High) — vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, according to the entry in the GitHub Advisory Database (status — unreviewed)
- Affected component: Microsoft Malware Protection Engine (Microsoft Defender engine)
- Type: local privilege escalation to NT AUTHORITY\SYSTEM
- Tested platforms: Windows 11 25H2, Windows Server 2025
- Patch status: according to Qualys as of August 27, 2026, no fix from Microsoft has been released
ShieldBreak is positioned as a patch bypass for the previously fixed vulnerability CVE-2026-50656 (RoguePlanet), which also has a CVSS score of 7.8. According to the Microsoft Defender documentation, RoguePlanet was addressed in the June 30, 2026 update (platform 4.18.26060.3008, engine 1.1.26060.3008). However, this fix applies specifically to CVE-2026-50656, not to CVE-2026-69414—these vulnerabilities should not be conflated.
Technically, ShieldBreak combines several attack vectors: manipulation of the Cloud Files API, the NT Object Manager namespace, direct invocation of Windows Defender APIs, and a race condition in the threat remediation process. The result is the redirection of Defender’s own cleanup mechanism to write an arbitrary DLL into System32, followed by execution as SYSTEM via a built-in Windows Error Reporting task.
Impact assessment
The three disclosures affect products from three of the largest endpoint protection vendors: CrowdStrike, Kaspersky, and Microsoft. The common thread across all three vulnerabilities is the abuse of the threat remediation mechanisms of the protection solutions themselves for privilege escalation. This creates a paradoxical situation in which security tools potentially become an attack vector.
Organizations at greatest risk are those using the mentioned products on Windows 11 25H2 and Windows Server 2025 systems. However, the degree of validation of the threats differs substantially:
- ShieldBreak (CVE-2026-69414): high degree of confidence — CVE assigned, independent Qualys analysis, CVSS score 7.8
- FalconFlank and HardBreacher: low degree of confidence — researcher claims only, no CVE and no independent validation
Recommendations
For organizations using the affected products:
- Microsoft Defender: monitor for the release of an update for CVE-2026-69414 via the MSRC portal. Ensure the fix for CVE-2026-50656 (platform 4.18.26060.3008) is already installed. Consider applying the temporary measures described in the Qualys analysis until an official patch is available.
- CrowdStrike Falcon: follow official CrowdStrike security advisories. In the absence of vendor confirmation of the vulnerability, no immediate action is required, but enhanced monitoring of events related to Office macro handling is advisable.
- Kaspersky Endpoint Security: similarly, monitor the vendor’s response. Watch for anomalous behavior of Kaspersky user interface processes and the appearance of unexpected DLL files in System32.
- For all three products: strengthen monitoring of file creation in the C:\Windows\System32 directory, especially DLL files created by unprivileged processes.
Response priority should focus on ShieldBreak (CVE-2026-69414) as the only one of the three vulnerabilities with an assigned CVE and independent analysis. For FalconFlank and HardBreacher, a watchful waiting mode is sufficient until vendor confirmation or CVE assignment appears. Organizations running Microsoft Defender on Windows 11 25H2 and Windows Server 2025 are advised to apply available mitigations for CVE-2026-69414 and install the update as soon as Microsoft releases it.
