Zero-Days and Critical Flaws: CrowdStrike Falcon, Chrome, Elementor Pro, Super Forms, Plex, Cisco Nexus

CrowdStrike Falcon Zero-Day Abuses Macro Remediation for SYSTEM Access

A researcher going by Nightmare Eclipse has published FalconFlank, an unpatched privilege-escalation exploit targeting fully updated Windows systems running CrowdStrike Falcon Sensor.

What You Need to Know

FalconFlank is a reported zero-day that abuses Falcon's Microsoft Office malicious macro remediation feature to gain NT AUTHORITY\SYSTEM privileges on Windows 11 25H2 and Windows Server 2025. No CVE has been assigned yet, and CrowdStrike says it's investigating the claims. The exploit doesn't grant initial access on its own, but any endpoint already running Falcon should be reviewed against CrowdStrike's guidance now.

What's Vulnerable

The technique targets Falcon's suspicious macro removal capability rather than a traditional code flaw in the sensor itself. An attacker who already has code execution or a foothold on an endpoint can allegedly use the feature to escalate from a lower-privileged context to SYSTEM. Endpoint security products run with elevated privileges by design, which makes flaws in their detection, remediation, and driver-adjacent functionality especially valuable once an attacker is already on a box. From SYSTEM, an attacker can disable or modify security controls, access protected credentials and registry hives, create persistent services, and move laterally with elevated rights.

Why This Matters

Falcon is deployed widely across enterprise environments specifically because it's trusted to run with high privileges. That trust is exactly what makes a flaw in its remediation logic dangerous. An attacker doesn't need a sophisticated initial-access chain to turn this into a full compromise, they just need a foothold they already have, plus this one escalation step.

What to Do

CrowdStrike has advised customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting tied to the affected feature, and says Cloud Anti-malware for Microsoft Office Files settings still provide protection. Full technical guidance is available through a FalconFlank alert in the CrowdStrike support portal. Before making the change, weigh it against your existing malware-prevention controls so the mitigation doesn't unintentionally weaken protection against malicious Office documents elsewhere. On the detection side, watch for unusual child processes from Falcon-related components, especially command shells or script interpreters launched in a SYSTEM context, along with newly created services, scheduled tasks, changes to security exclusions, and suspicious use of signed security-tool processes following Office document activity.

Since the exploit details are public and a proof of concept may be adaptable, treat any suspicious macro-remediation event followed by privilege escalation as a high-priority investigation.

Google Patches Actively Exploited Chrome Zero-Day

Google has shipped a Chrome update fixing a high-severity zero-day already being used in attacks, along with 11 other vulnerabilities across the browser.

What You Need to Know

CVE-2026-85046, a type-confusion flaw in Chrome's V8 JavaScript and WebAssembly engine, is confirmed to have an exploit in the wild. Google is withholding technical details while the fix rolls out. The update lands in Chrome 152.0.7977.82/.83 on Windows and macOS and 152.0.7977.82 on Linux, and this is the sixth Chrome zero-day Google has patched in 2026.

What's Vulnerable

Type confusion happens when software mishandles one object type as another, and in V8 that opens the door for a malicious site to use crafted JavaScript or WebAssembly to corrupt memory inside the browser's renderer process. Chrome's sandboxing limits what a renderer-level compromise can do on its own, but attackers routinely pair browser zero-days with sandbox-escape bugs, OS privilege-escalation flaws, or social engineering to push further into a system. The same update also resolves high-severity use-after-free, out-of-bounds memory, and race-condition issues in WebGL, CacheStorage, DevTools, Skia, Network, Compositing, and Crash Reporting.

Why This Matters

Browsers are exposed to untrusted content constantly, through phishing links, malicious ad networks, and compromised legitimate sites. An actively exploited V8 flaw means that exposure isn't theoretical right now, someone is already using it.

What to Do

Push the patched Chrome build across managed Windows, macOS, and Linux fleets and confirm users actually restart the browser, since the fix doesn't apply until then. Keep an eye on other Chromium-based browsers too, including Edge, Brave, Opera, and Vivaldi, as they may lag behind on pulling in the upstream V8 fix. Enforcing automatic updates and flagging systems that haven't checked in with current browser telemetry will help close the gap faster. On the monitoring side, review alerts for suspicious browser child processes, unexpected script execution from browser directories, unusual downloads, and activity following visits to newly registered or low-reputation domains.

440,000+ Exploit Attempts Hit WordPress Plugin Upload Flaws

Wordfence has tracked mass exploitation of arbitrary file-upload vulnerabilities in two widely used WordPress plugins, Super Forms and Elementor Pro.

What You Need to Know

Attackers have made more than 440,000 attempts to exploit CVE-2026-14894 in Super Forms and CVE-2026-32475 in Elementor Pro, both of which let an unauthenticated attacker upload a malicious PHP file to a vulnerable site. Successful exploitation can lead to remote code execution, backdoor access, new admin accounts, data theft, or full site compromise. Sites running either plugin should confirm they're patched immediately.

The Super Forms Attack

Exploitation of CVE-2026-14894 began July 14 and peaked at more than 40,000 requests in a single day on August 18, with Wordfence blocking over 250,000 attempts total. Attackers abuse the plugin's super_submit_form AJAX action, submitting a Base64-encoded payload disguised as image content alongside an attacker-controlled .php filename. The payload deploys a PHP uploader web shell capable of delivering additional malware. Presenting the file as data:image/gif;base64 while the underlying content is executable PHP shows how easily client-supplied file-type metadata can be spoofed when server-side validation isn't strict enough.

The Elementor Pro Attack

CVE-2026-32475 exploitation started August 19, with more than 190,000 attempts blocked, and targets any Elementor Pro site with a published page containing a Form widget that has a File Upload field. Attackers submit the upload field as an array with an empty first element and a malicious PHP payload as the second. Elementor stores the resulting file in /wp-content/uploads/elementor/forms/ with a randomized name but keeps the .php extension, letting the attacker request it directly and execute commands on the server.

Why This Matters

Both flaws are exploitable without authentication, and internet-exposed file-upload functionality is a common blind spot, especially when a plugin processes user-controlled file names, MIME types, or nested form data without strict server-side checks.

What to Do

Update Super Forms and Elementor Pro to their patched versions immediately, and don't overlook unmanaged staging or legacy sites that may still be running vulnerable copies. Review web-server logs for anomalous POST requests to /wp-admin/admin-ajax.php, and inspect upload directories, particularly WordPress uploads and Elementor form folders, for newly created or recently modified PHP files. Treat any unexpected PHP file in an upload path as a likely compromise indicator and investigate for web shells, modified admin accounts, unauthorized scheduled tasks, malicious redirects, and unusual outbound connections from the web server.

Plex Urges Immediate Updates for Server and Desktop

Plex has released security fixes for undisclosed vulnerabilities in Plex Media Server and Plex Desktop, with self-hosted, internet-facing instances carrying the most risk.

What You Need to Know

Plex Media Server 1.43.3 and Plex Desktop 1.115.0 patch multiple vulnerabilities that Plex hasn't detailed publicly, saying only that CVE requests are in progress. The lack of technical detail doesn't lower the urgency, especially for the more than 360,000 Plex Media Server instances Censys shows exposing their web interface to the internet.

What's New

Plex hasn't published severity ratings, vulnerability classifications, or CVE identifiers for this release, but management interfaces, user accounts, media libraries, and connected devices are all potentially in scope for an externally accessible server. Not every exposed instance is necessarily vulnerable, but internet-facing deployments raise the stakes because attackers can quickly fingerprint outdated versions through banner grabbing and automated scanning. Admins running Plex on NAS devices should check whether their vendor's package repository has the updated build yet, and if not, Plex recommends installing the update manually rather than waiting.

The Backstory

Plex has a track record of vulnerabilities with real downstream impact. In 2025, CVE-2025-34158 exposed the server owner's administrative access token to lower-privileged authenticated users through the /myplex/account endpoint, and attackers could then use the /api/resources endpoint to enumerate other Plex servers accessible to the compromised account. Plex flaws have also shown up in bigger incidents, including the 2022 LastPass breach, where attackers used CVE-2020-5741 to compromise an employee's home device and install keylogging malware.

Why This Matters

A self-hosted media server might not feel like a high-value target, but Plex's history shows these flaws can chain into credential exposure, infrastructure discovery, and even employee device compromise that reaches well beyond the media library itself.

What to Do

Update Plex Media Server to 1.43.3 or later and Plex Desktop to 1.115.0 or later, and confirm the install completed through the application interface or endpoint-management telemetry. Inventory any exposed Plex servers, restrict administrative access to VPN or trusted networks where you can, and remove public exposure that isn't necessary. Review logs for unusual authentication activity, unexpected administrative changes, new client connections, account or resource API requests, and outbound connections from the Plex host that don't match normal media-server behavior.

Critical Cisco Nexus 9000 Flaw Enables Root-Level Remote Code Execution

Cisco has patched a critical, network-reachable flaw affecting 10 Nexus 9000 switch models that allows unauthenticated remote code execution as root.

What You Need to Know

CVE-2026-20212 carries a CVSS score of 9.8 and affects 10 Silicon One-based Nexus 9000 switch models. Cisco disclosed it September 2 with no known exploitation so far, but the combination of a remotely reachable attack path and root-level impact makes this a high-priority patch for anyone running the affected hardware.

What's Vulnerable

The flaw comes from a service binding to unrestricted IP addresses in the default Layer 3 VRF instance, which leaves TCP ports 43210 and 43211 reachable to anyone with network access to the switch. Sending crafted input to that exposed service lets an attacker execute code with root privileges, and exploitation can also crash the S1HAL process and force a device reload, creating an availability problem on top of the compromise risk. Affected models include the N9324C-SE1U, N9348Y2C6D-SE1U, N9364E-SG2-O, N9364E-SG2-Q, N9396T12C-SE1, N9348Y12C-SE1, N9396Y12C-SE1, N9336C-SE1, N9K-C9804, and N9K-C9808. Nexus 9000 switches in ACI mode, and Nexus 3000 and 7000 devices, are not affected.

Additional Cisco Hardening

The disclosure lands alongside separate IOS XR hardening updates covering seven umbrella CVEs across all IOS XR releases, two of which, CVE-2026-20274 and CVE-2026-20279, also carry maximum CVSS scores of 9.8. Cisco is advising IOS XR customers to upgrade to a supported release and apply the relevant software maintenance updates.

Why This Matters

Root-level compromise of a Nexus 9000 switch means full control over a device that often sits at the center of data-center, campus, or network-fabric operations. Even without confirmed exploitation yet, the low bar for reachability and the severity of the outcome make this the kind of flaw attackers move quickly to weaponize once details circulate.

What to Do

Use Cisco's Software Checker to identify the correct fixed NX-OS release for your hardware, and validate whether TCP ports 43210 and 43211 are reachable from management, production, or external network segments before scheduling upgrades around redundancy and change-management needs. Where an immediate upgrade isn't possible, Cisco's Live Protect shield lp00031 offers temporary mitigation for limited NX-OS 10.6(3) and 10.6(3s) deployments, though it doesn't support the Nexus 9804 or 9808. Otherwise, apply infrastructure ACLs that permit only necessary management and control-plane traffic, or block inbound connections to the two affected ports outright. IOS XR customers should upgrade separately per Cisco's guidance for that hardening round. Review device logs and telemetry for unexpected connections to the affected ports, unexplained process crashes or reloads, configuration discrepancies, new tunnel interfaces, and unauthorized outbound connections from network devices.

Sign-off options (pick one per post, or mix and match)

Soft CTA: "If you're not sure whether your environment is exposed to any of this week's flaws, that's exactly the kind of gap Hunter Strategy's threat intelligence team can help you close."

Plain wrap-up: "Patch cadence and exposure visibility remain the two biggest levers here, and this week's advisories are a reminder to keep both current."

What Changed

• Combined five separate raw articles into five standalone posts rather than one long roundup, since each covers a distinct product and CVE.
• For the WordPress and Cisco posts, used two topic-adapted body sections instead of one, since each raw draft covered two distinct vulnerabilities/products worth separating for scannability (Super Forms vs. Elementor Pro; Nexus 9000 vs. IOS XR).
• For the Plex post, split "current patch" content from the 2025/2022 historical incidents into "What's New" and "The Backstory" so the announcement doesn't get buried under history.
• Kept the Cisco switch model list as inline prose (comma-separated) rather than bullets, since it reads as a qualifier within a sentence rather than a standalone spec list.
• No CVE numbers, version numbers, or product names were dropped; all vendor guidance and mitigation steps were preserved and consolidated into "What to Do."
• If you want an SEO title/summary for this as a combined weekly roundup, let me know and I'll pull one together per the collection format.