Vulnerability in Crowdstrike Falcon Sensor For Windows
CVE-2026-40058
CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. An update is available immediately for versions 7.34 and above, 7.32 LTS, and 7.16 for Windows 7/2008 R2 systems. The Falcon sensor for Mac, Linux, and Legacy Systems are not affected. This vulnerability could expose an arbitrary file write to protected locations from an unprivileged context, potentially leading to local privilege escalation. The CrowdStrike Laroux Malware Cleanup Tool, based off of the same feature in the CrowdStrike Falcon sensor for Windows, is also affected. An update for this tool is also available immediately.
Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.001 (0.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 0th percentile — 0.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: 0.000
Affected products
- Crowdstrike Falcon Sensor For Windows — versions 7.33.0
- Crowdstrike Laroux Cleanup Tool
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-40058?
- CVE-2026-40058 is a high-severity vulnerability in Crowdstrike Falcon Sensor For Windows, classified under Time-of-check Time-of-use (TOCTOU) Race Condition. CVSS score: 8.8/10. Published 2026-09-15.
- How severe is CVE-2026-40058?
- High severity. CVSS v3 base score is 8.8 out of 10.