Read the docs
TI-2025-27746 Aliases CVE-2025-42706GHSA-f5rw-8c63-mm55

CrowdStrike Falcon Sensor for Windows Logic Error

Priority LOW 28CWE-346Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-346.

Summary

A logic error exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility (LTV) sensors. There is no indication of exploitation of these issues in the wild. Our threat hunting and intelligence teams are actively monitoring for exploitation and we maintain visibility into any such attempts. The Falcon sensor for Mac, the Falcon sensor for Linux and the Falcon sensor for Legacy Systems are not impacted by this. CrowdStrike was made aware of this issue through our HackerOne bug bounty program. It was discovered by Cong Cheng and responsibly disclosed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00178 7th percentileScored 2026-11-07
Fix Fixed Falcon sensor for Windows (CrowdStrike): 7.28.20008, 7.27.19909, 7.26.19813 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CrowdStrikeFalcon sensor for Windows7.28 to before 7.28.20008; 7.27 to before 7.27.19909; 7.26 to before 7.26.19813; 7.25 to before 7.25.19707; 7.24 to before 7.24.196087.28.20008, 7.27.19909, 7.26.19813, 7.25.19707, 7.24.19608Patch availableCNA
CrowdStrikeFalcon sensor for Windows7.16 to before 7.16.186377.16.18637Patch availableCNA
  • Falcon sensor for Windows VendorCrowdStrike Affected 7.28 to before 7.28.20008; 7.27 to before 7.27.19909; 7.26 to before 7.26.19813; 7.25 to before 7.25.19707; 7.24 to before 7.24.19608 Fixed in 7.28.20008, 7.27.19909, 7.26.19813, 7.25.19707, 7.24.19608 Patch available CNA
  • Falcon sensor for Windows VendorCrowdStrike Affected 7.16 to before 7.16.18637 Fixed in 7.16.18637 Patch available CNA

Remediation

  • Fix · CNA Falcon sensor for Windows (CrowdStrike) Fixed in 7.28.20008, 7.27.19909, 7.26.19813, 7.25.19707, 7.24.19608
  • Fix · CNA Falcon sensor for Windows (CrowdStrike) Fixed in 7.16.18637

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    CrowdStrike Falcon sensor for Windows 7.16.18637, 7.24.19608 and 4 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-27745 CrowdStrike Falcon Sensor for Windows Race ConditionPriority LOW 24
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-42706
  2. 2026-10-03 Alias added: GHSA-f5rw-8c63-mm55

References

Other 1

  • TI-2026-28892 CrowdStrike LogScale Unauthenticated Path Traversal CVSS 3.1CRITICAL 9.8
  • TI-2022-02634 CrowdStrike Falcon Uninstallation authorization CVSS 3.1LOW 2.7
  • TI-2026-28893 Vulnerability Affecting Office Macro Removal in CrowdStrike Falcon Sensor for Windows CVSS 3.1HIGH 8.8
  • TI-2025-00971 CrowdStrike Falcon Sensor for Linux TLS Issue CVSS 3.1HIGH 8.1
  • TI-2025-27745 CrowdStrike Falcon Sensor for Windows Race Condition CVSS 3.1MEDIUM 5.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences