Nightmare Eclipse: Zero-Days Hit CrowdStrike, Nvidia, Avast

Three security products running on Windows endpoints landed in the zero-day crosshairs on September 7. A threat actor calling itself Nightmare Eclipse published proof-of-concept exploit code targeting CrowdStrike Falcon, Nvidia display drivers, and Avast antivirus, per SecurityWeek. The exploits achieve local privilege escalation to SYSTEM, reportedly spawning a privileged shell on affected Windows machines. No CVE IDs have been assigned for any of the three. None of the vendors had issued a security advisory as of publication.

What the exploits do

All three targets share the same attack class: local privilege escalation from a low-privileged account to SYSTEM, Windows’ fully privileged local context. SYSTEM access is the standard prerequisite for credential dumping, disabling endpoint protection, and establishing persistence. SecurityWeek reports the exploits spawn a shell with System privileges.

These are not remote code execution bugs. An attacker needs an existing foothold before any of this is useful. That narrows the threat model, but does not reduce urgency by much. Ransomware operators and APT groups typically reach the privilege escalation step after initial access, not before it. A working public exploit speeds up the timeline from initial access to full control.

CrowdStrike’s kernel-mode driver surface has already drawn scrutiny this week. The FalconFlank PoC from September 3 targeted the same product family. These appear to be separate, independently developed exploits rather than a continuation of that research.

CVE and patch status

No CVE IDs have been confirmed for any of the three vulnerabilities. No vendor patches are available as of the SecurityWeek report. Vendors have been contacted for comment but had not issued advisories at publication time.

Watch vendor security bulletin channels directly. CrowdStrike, Nvidia, and Avast each publish security advisories through their official channels. When patches land, prioritize testing: all three products run at elevated privilege levels across every endpoint they protect.

What to do right now

Local priv esc exploits become dangerous once an attacker is already inside. Work from outside in.

Harden initial access and lateral movement paths before worrying about patch timelines. If attackers cannot reach an endpoint, local priv esc is irrelevant. If you are already investigating activity on a host, assume priv esc was on the table, especially given current threat-intel conditions: JSCeal credential-theft campaigns and similar initial-access malware are circulating this week, and chaining initial access into a priv esc is a realistic attack sequence.

Monitor CrowdStrike Falcon, Nvidia driver, and Avast update channels for emergency patch releases and set automated updates if policy allows it. Test patches fast once they ship. SYSTEM-level products with public exploits and no patch are exposure windows, not a wait-and-see situation.

Review EDR telemetry for SYSTEM-level process spawns originating from driver-layer processes. That is the indicator to watch on high-value hosts before vendor patches are available. Check for indicators of compromise on those systems now.

For context on how public exploit releases translate to real-world incident timelines, see the Telerik UI RCE chain disclosure from earlier today: PoC availability compresses attacker timelines from weeks to hours. These three disclosures follow the same pattern.