Metasploit Framework

No entries match these filters. Clear filters

1. docs update Sep 8, 2026 · issue 068

   Metasploit adds four new modules: three HTTP exploit modules and a new auxiliary scanner/evasion module.

   • Adds exploit/multi/http/mcpjam_inspector_rce remote code executionremote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. exploit module targeting MCPJam Inspector.
   • Adds exploit/multi/http/papercut_ng_external_user_lookup_rce remote code execution exploit module targeting PaperCut NG external user lookup.
   • Adds exploit/multi/http/simplehelp_oidc_auth_bypass_rce exploit module targeting SimpleHelp OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication bypass leading to RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives..
   • Adds evasion/linux/x64/sandbox_gate evasion module for Linux x64 sandbox evasion.
   • Adds auxiliary/scanner/msf/handler_detect scanner module for detecting Metasploit handlers.

   5 details in Everything

2. docs update Aug 23, 2026 · issue 054

   Metasploit adds RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. modules for Flowise and Langflow, a Forgejo file-read gather module, and new Linux MIPS64 payload stagers.

   • Adds exploit/multi/http/flowise_mcp_rce exploit module targeting remote code executionremote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. in Flowise via HTTP.
   • Adds exploit/multi/http/langflow_unauth_rce_cve_2026_9198 exploit module for unauthenticated RCE in Langflow.
   • Adds auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774 gather module for arbitrary file read in Forgejo.
   • Adds auxiliary/scanner/http/concrete_cms_file_usage_disclosure scanner module for file usage disclosure in Concrete CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly..
   • Adds Linux MIPS64 payload stagers: payload/cmd/linux/ftp/mips64/exec, payload/cmd/linux/http/mips64/exec, payload/cmd/linux/https/mips64/exec, payload/cmd/linux/tftp/mips64/exec, and payload/linux/mips64/exec, expanding post-exploitation coverage to MIPS64 Linux targets.

   5 details in Everything

3. advisory CVE-2026-41316 Aug 6, 2026 · issue 128
   • CVE-2026-41316: db_import unsafe deserialisation (CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-502) exposes Metasploit to code execution via crafted XML/ZIP import (related to CVE-2026-41316) (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.0, affects >= 4.0, < 6.5.5)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
4. docs update Jul 31, 2026 · issue 031

   Metasploit adds RISC-V encoders/payloads, FTP/PHP payload delivery channels, HTTP-to-SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. relay, and new exploit modules across Linux, macOS, Windows, and multi-platform targets.

   • Adds RISC-V 32-bit and 64-bit little-endian encoder modules (encoder/riscv32le and encoder/riscv64le), including byte XOR and long XOR variants, enabling shellcode encoding for RISC-V embedded and IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. targets.
   • Adds FTP-based payload delivery channel for Linux across aarch64, armbe, armle, mips64, mipsbe, mipsle, ppc, ppc64, riscv32le, riscv64le, x64, and x86 architectures, supporting meterpreter and shell payloads.
   • Adds FTP-based payload delivery channel for Windows x64, covering meterpreter, shell, peinject, vncinject, and custom payload types.
   • Adds HTTP and HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. payload delivery channels for Linux riscv32le and riscv64le architectures.
   • Adds TFTPTFTPTrivial File Transfer Protocol, a minimal UDP-based file transfer protocol standardized in RFC 1350, used by cyber tools when simplicity and low overhead matter more than authentication or error recovery. payload delivery channel for Linux riscv32le and riscv64le architectures.

   +7 more show less

   • Adds PHP meterpreter reverse HTTP/HTTPS payload (payload/cmd/unix/php/meterpreter/reverse_http and reverse_https) for Unix targets.
   • New auxiliary/server/relay/http_to_smb relay module for relaying HTTP authentication to SMB.
   • New exploit/linux/persistence/apache_htaccess persistence module for Linux Apache targets.
   • New exploit/osx/local/packagekit_zshenv_privesc local privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. module for macOS.
   • New exploit/windows/misc/peyara_remote_mouse_rce remote code executionremote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. module for Windows.
   • New multi-platform exploit modules: Flowise unauthenticated RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives., Joomla JCE unauthenticated file upload RCE, and WordPress Pix plugin unauthenticated RCE.
   • New scanner modules for Audiobookshelf auth bypass, LiteLLM Proxy SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does., and Next.js middleware auth bypass.

   12 details in Everything