CVE-2026-40058Patch

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. An update is available immediately for versions 7.34 and above, 7.32 LTS, and 7.16 for Windows 7/2008 R2 systems. The Falcon sensor for Mac, Linux, and Legacy Systems are not affected. This vulnerability could expose an arbitrary file write to protected locations from an unprivileged context, potentially leading to local privilege escalation. The CrowdStrike Laroux Malware Cleanup Tool, based off of the same feature in the CrowdStrike Falcon sensor for Windows, is also affected. An update for this tool is also available immediately.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://www.crowdstrike.com/en-us/security-advisories/cve-2026-40058/

Weakness type (CWE)

CWE-367

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 3 signals
Peaked 2d ago at 1 mentions (2026-09-17); latest day: 1
3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d

Signal classification1 categories

Patch

3100.0%

Referenced assets2 URLs

By indicator

Full discourse3 posts

Cybersecurity News DE@cybsecuritynews45d
Patch
#schwachstellen CrowdStrike Falcon für Windows: Sicherheitsupdate gegen lokale Rechteausweitung durch CVE-2026-40058 #crowdstrike #cve202640058 #falconsensor #larouxmalwarecleanuptool #microsoftoffice #windows https://cybersecurity-news.de/crowdstrike-falcon-windows-cve-2026-40058
Post summary
The tweet announces a security update for CrowdStrike Falcon on Windows to address CVE-2026-40058, a local privilege escalation vulnerability, linking to a news article for details.
0000174
12 followersView on X
Anthony Bahn@HoustonIntrove144d
Patch
Falcon fleets with Office malicious-macro removal enabled: check sensor versions tonight. CVE-2026-40058 is a TOCTOU race on Windows Falcon. Low-priv local user can write protected paths and escalate (CVSS 8.8). Mac/Linux sensors not in scope. Ship 8.10.21408, 7.40.21309, or the matching fixed build for your branch. Temp workaround: disable that macro-removal policy.
Post summary
The post describes CVE-2026-40058 as a TOCTOU race condition in Windows Falcon with CVSS 8.8, and advises upgrading to specific sensor versions or disabling the macro-removal policy as a temporary workaround.
0000041
36 followersView on X
Venkata Satish Guttula 🛰️@snakeyesV144d
Patch
News: CrowdStrike Falcon Sensor CVE-2026-40058 (CVSS 8.8) is a TOCTOU race in Office malicious-macro removal. A local low-priv user can reach SYSTEM when that policy is on. Hits Windows Falcon below fixed builds (8.10.21408, 7.40.21309, and peers). Patch now, or disable the macro-removal policy until you do. https://www.crowdstrike.com/en-us/security-advisories/cve-2026-40058/
Post summary
CrowdStrike disclosed CVE‑2026‑40058, a TOCTOU race in the Falcon Sensor’s macro removal feature that can let a low‑privileged user achieve SYSTEM rights on Windows versions prior to 8.10.21408/7.40.21309. The vendor recommends applying the available patch or disabling the macro‑removal policy as a temporary workaround.
0000080
3.0K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-40058

Anthony Bahn[verified]@HoustonIntrove1Patch

The post describes CVE-2026-40058 as a TOCTOU race condition in Windows Falcon with CVSS 8.8, and advises upgrading to specific sensor versions or disabling the macro-removal policy as a temporary workaround.

Venkata Satish Guttula 🛰️[verified]@snakeyesV1Patch

CrowdStrike disclosed CVE‑2026‑40058, a TOCTOU race in the Falcon Sensor’s macro removal feature that can let a low‑privileged user achieve SYSTEM rights on Windows versions prior to 8.10.21408/7.40.21309. The vendor recommends applying the available patch or disabling the macro‑removal policy as a temporary workaround.

Cybersecurity News DE@cybsecuritynewsPatch

The tweet announces a security update for CrowdStrike Falcon on Windows to address CVE-2026-40058, a local privilege escalation vulnerability, linking to a news article for details.