https://cybertoolchain.io/tools/metasploit-pro New releases and features in Metasploit Pro, tracked by The Cyber Toolchain. en Mon, 19 Oct 2026 00:00:00 GMT https://docs.rapid7.com/insight/release-notes-5.1.0-2026101901 https://docs.rapid7.com/insight/release-notes-5.1.0-2026101901 Mon, 19 Oct 2026 00:00:00 GMT Metasploit Pro 5.1.0-2026101901 adds 20 new modules targeting AI/LLM platforms, snap-confine, MongoDB, and Windows AArch64 fetch adapters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `mongodb_version`, `mongodb_login`, `mongodb_schemadump`, and `mongodb_hashdump` auxiliary modules for MongoDB enumeration and credential harvesting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Windows AArch64 fetch adapters, extending payload delivery to ARM64 Windows targets. • Updates `post/linux/gather/enum_protections` to detect AV/EDR software present on the target system. • Adds a Windows persistence module that leverages the Ollama auto-update mechanism. • Adds a post module that uploads a PAM shared object file into the Linux authentication chain, compiling it on-target when the system is not x64. • Adds an exploit module for CVE-2026-42271, a command execution flaw in BerriAI LiteLLM proxy MCP test REST endpoints. • Adds exploit modules for OpenCTI: one chaining CVE-2026-27960 and CVE-2026-39980 for unauthenticated remote command execution, and a SafeJS sandbox escape achieving RCE as root inside the API container (versions 6.8.16 and above). • Adds an exploit module for CVE-2026-53959, a broken access control flaw in 4gaBoards versions 3.3.8 and below exposing the `/api/users` REST endpoint and fields including `ssoGoogleEmail` and `ssoGithubEmail`. • Adds an exploit module for EDB-52079, an unauthenticated RCE in dizqueTV (Node.js IPTV server). • Adds an authenticated exploit module for CVE-2024-9264, a DuckDB command injection in Grafana SQL Expressions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/metasploit-pro https://docs.rapid7.com/insight/release-notes-5.1.0-2026093001 https://docs.rapid7.com/insight/release-notes-5.1.0-2026093001 Thu, 01 Oct 2026 00:00:00 GMT Metasploit Pro 5.1.0-2026093001 adds 41 new modules including OPC-UA, Kerberos relay, IPv6 DNS-takeover, and Windows AArch64 payloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `auxiliary/scanner/scada/opcua_enum`, a scanner module that detects OPC-UA servers speaking the OPC-UA TCP binary transport (`opc.tcp://`).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `SessionType` option to `auxiliary/scanner/winrm/winrm_login` to create a cmd-backed shell, a PSRP-backed PowerShell session, or automatically fall back to PowerShell when cmd shell creation is denied. • Adds `MSFLOGO=nyan-cat.txt` environment variable support to `msfconsole` for selecting the nyan cat banner. • Adds a new command-line flag to `msfconsole` to print the count of modules. • Updates JSON RPC support to now require authentication by default, either via the database with user credentials or an auth token. • Introduces native Kerberos authentication relay capabilities to the framework's relay stack, including the new `esc8_kerberos` auxiliary module for exploiting AD CS Web Enrollment (ESC8). • Adds `auxiliary/spoof/ipv6/ipv6_ra_dns_takeover` and `auxiliary/spoof/dhcp/dhcpv6_dns_takeover` modules to enable native IPv6 DNS-takeover coercion as part of a Kerberos authentication relay attack chain. • Adds `KerberosTicketTrace` support to the `auxiliary/admin/kerberos/forge_ticket` module. • Introduces `Rex::Proto::Gss::KerberosToken` as a shared low-level implementation for handling Kerberos tokens carried by GSS-API and SPNEGO. • Adds Windows AArch64 staged shell payloads. • Extends `windows/smb/psexec` to work with AArch64 targets. • Adds a MIPS64 exec payload, updates the MIPSEL and MIPSBE exec payloads, and adds prepends for all three. • Adds a multi-platform persistence module for Kate. • Adds a scanner module that enumerates ports on a host to determine whether each is a Metasploit reverse handler and what kind of shell it expects. • Adds an auxiliary scanner module that fingerprints Inductive Automation Ignition gateways across all major version families by probing unauthenticated info endpoints. • Adds a Linux x64 sandbox-evasion module that performs runtime environment checks and aborts execution when a likely sandbox or VM is detected. • Adds `auxiliary/scanner/http/spip_annee_sqli`, which exploits a blind SQL injection in SPIP's date column escaping logic. • Updates the ZoomEye search module to support the ZoomEye v2 API, adds a three-attempt retry limit, and caps results per page at 10. • Adds support to the post mixin for Windows sessions to run the `.writable?` method. • Updates persistence modules to use `create_process` instead of `cmd_exec`. • Improves start-up performance of `msfconsole`. Breaking changes: • JSON RPC now requires authentication by default (via database credentials or auth token); existing unauthenticated JSON RPC clients will be rejected on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/metasploit-pro https://docs.rapid7.com/insight/release-notes-5.1.0-2026093001 https://docs.rapid7.com/insight/release-notes-5.1.0-2026093001 Thu, 01 Oct 2026 00:00:00 GMT Metasploit Pro 5.1.0-2026093001 adds 41 new modules including OPC-UA, Kerberos relay, IPv6 DNS-takeover, and Windows AArch64 payloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `auxiliary/scanner/scada/opcua_enum`, a scanner module that detects OPC-UA servers speaking the OPC-UA TCP binary transport (`opc.tcp://`).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `SessionType` option to `auxiliary/scanner/winrm/winrm_login` to create a cmd-backed shell, a PSRP-backed PowerShell session, or automatically fall back to PowerShell when cmd shell creation is denied. • Adds `MSFLOGO=nyan-cat.txt` environment variable support to `msfconsole` for selecting the nyan cat banner. • Adds a new command-line flag to `msfconsole` to print the count of modules. • Updates JSON RPC support to now require authentication by default, either via the database with user credentials or an auth token. • Introduces native Kerberos authentication relay capabilities to the framework's relay stack, including the new `esc8_kerberos` auxiliary module for exploiting AD CS Web Enrollment (ESC8). • Adds `auxiliary/spoof/ipv6/ipv6_ra_dns_takeover` and `auxiliary/spoof/dhcp/dhcpv6_dns_takeover` modules to enable native IPv6 DNS-takeover coercion as part of a Kerberos authentication relay attack chain. • Adds `KerberosTicketTrace` support to the `auxiliary/admin/kerberos/forge_ticket` module. • Introduces `Rex::Proto::Gss::KerberosToken` as a shared low-level implementation for handling Kerberos tokens carried by GSS-API and SPNEGO. • Adds Windows AArch64 staged shell payloads. • Extends `windows/smb/psexec` to work with AArch64 targets. • Adds a MIPS64 exec payload, updates the MIPSEL and MIPSBE exec payloads, and adds prepends for all three. • Adds a multi-platform persistence module for Kate. • Adds a scanner module that enumerates ports on a host to determine whether each is a Metasploit reverse handler and what kind of shell it expects. • Adds an auxiliary scanner module that fingerprints Inductive Automation Ignition gateways across all major version families by probing unauthenticated info endpoints. • Adds a Linux x64 sandbox-evasion module that performs runtime environment checks and aborts execution when a likely sandbox or VM is detected. • Adds `auxiliary/scanner/http/spip_annee_sqli`, which exploits a blind SQL injection in SPIP's date column escaping logic. • Updates the ZoomEye search module to support the ZoomEye v2 API, adds a three-attempt retry limit, and caps results per page at 10. • Adds support to the post mixin for Windows sessions to run the `.writable?` method. • Updates persistence modules to use `create_process` instead of `cmd_exec`. • Improves start-up performance of `msfconsole`. Breaking changes: • JSON RPC now requires authentication by default (via database credentials or auth token); existing unauthenticated JSON RPC clients will be rejected on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/metasploit-pro https://docs.rapid7.com/insight/release-notes-5.1.0-2026073001 https://docs.rapid7.com/insight/release-notes-5.1.0-2026073001 Mon, 03 Aug 2026 00:00:00 GMT Metasploit Pro 5.1.0-2026073001 adds MALLEABLEC2 HTTP(S) shaping, 8 new MCP tools, RISC-V payloads, expanded CertificateTrace/KerberosTicketTrace, and an HTTP-to-SMB NTLM relay module. • Adds `MALLEABLEC2` option to all Meterpreter HTTP(S) payloads (Windows, Java, Python, PHP, Linux) to load a standard Malleable C2 profile and reshape HTTP(S) traffic. • Adds `--enable-dangerous-actions` flag to the `msfmcpd` CLI to opt in to dangerous actions across the eight new MCP tools that wrap existing RPC endpoints for module and session control. • Adds eight new MCP tools wrapping existing RPC endpoints for module and session control, backed by strict per-tool input validation. • Adds `run_uuid` job tracking across all module types when executed through RPC endpoints to support MCP tool integrations. • Extends `CertificateTrace` peer cert tracing (using the existing `off` / `metadata` / `full` enum) to LDAP over TLS and RDP. • Extends `CertificateTrace` to surface the server's TLS peer certificate when an HTTP module connects over HTTPS, using the same `off` / `metadata` / `full` enum. • Adds a Certificate Signing Request (CSR) trace to the `CertificateTrace` functionality so operators can see the CSR printed when requesting certificates from AD CS. • Adds `CertificateTrace` peer cert tracing to PostgreSQL over TLS, and passes the `SSL` datastore option through to the underlying Postgres connection. • Adds improved granularity to `KerberosTicketTrace`: operators can now print the full trace, only tickets, or only metadata. • Reuses `KerberosTicketTrace` formatting for offline Kerberos artifact workflows so stored and converted tickets render with the same output style as live authentication. • Adds Bearer Authentication support to the MCP server plugin. • Adds `ftp_fingerprint` and `ftp_list_directory` methods to the `Exploit::Remote::Ftp` mixin, leveraging recog to fingerprint targets from their banners. • Adds `resource` and `parents` fields to the `msf_service_info` MCP tool, `resource` to `msf_vulnerability_info`, `data` to `msf_note_info`, and `realm_key` / `realm_value` to `msf_credential_info`. • Adds four encoder variants for both RISC-V 32-bit and 64-bit little-endian architectures. • Adds `reverse_tcp` and `bind_tcp` stagers and a shell command stage for RISC-V 64-bit and 32-bit little-endian Linux targets. • Adds Windows on ARM (AArch64) reverse-TCP command-shell payload. • Adds Linux fetch multi payloads, a fetch server for FTP-based fetch payloads, and a TFTP server to `rex/proto`. • Adds a new persistence module `exploits/linux/persistence/apache_htaccess` that plants a mod_cgi `.htaccess` web shell on Linux Apache targets. • Adds an HTTP-to-SMB NTLM relay server module that relays incoming NTLM HTTP authentication requests to multiple SMB servers to establish SMB sessions. • Pro: Adds support for selecting Malleable C2 profiles from the single module run page, the payload generator, and the global persistent listeners page. • Pro: Adds multiple enhancements to the network topology page. • Pro: Adds a warning alert in the payload generator when `encoder/none` or `encoder/eicar` is selected. • Improves `scanner/ftp/ftp_version` to report the service when a host is up but no FTP banner is received. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/metasploit-pro https://docs.rapid7.com/insight/release-notes-5.1.0-2026073001 https://docs.rapid7.com/insight/release-notes-5.1.0-2026073001 Mon, 03 Aug 2026 00:00:00 GMT Metasploit Pro 5.1.0-2026073001 adds MALLEABLEC2 HTTP(S) shaping, 8 new MCP tools, RISC-V payloads, expanded CertificateTrace/KerberosTicketTrace, and an HTTP-to-SMB NTLM relay module. • Adds `MALLEABLEC2` option to all Meterpreter HTTP(S) payloads (Windows, Java, Python, PHP, Linux) to load a standard Malleable C2 profile and reshape HTTP(S) traffic. • Adds `--enable-dangerous-actions` flag to the `msfmcpd` CLI to opt in to dangerous actions across the eight new MCP tools that wrap existing RPC endpoints for module and session control. • Adds eight new MCP tools wrapping existing RPC endpoints for module and session control, backed by strict per-tool input validation. • Adds `run_uuid` job tracking across all module types when executed through RPC endpoints to support MCP tool integrations. • Extends `CertificateTrace` peer cert tracing (using the existing `off` / `metadata` / `full` enum) to LDAP over TLS and RDP. • Extends `CertificateTrace` to surface the server's TLS peer certificate when an HTTP module connects over HTTPS, using the same `off` / `metadata` / `full` enum. • Adds a Certificate Signing Request (CSR) trace to the `CertificateTrace` functionality so operators can see the CSR printed when requesting certificates from AD CS. • Adds `CertificateTrace` peer cert tracing to PostgreSQL over TLS, and passes the `SSL` datastore option through to the underlying Postgres connection. • Adds improved granularity to `KerberosTicketTrace`: operators can now print the full trace, only tickets, or only metadata. • Reuses `KerberosTicketTrace` formatting for offline Kerberos artifact workflows so stored and converted tickets render with the same output style as live authentication. • Adds Bearer Authentication support to the MCP server plugin. • Adds `ftp_fingerprint` and `ftp_list_directory` methods to the `Exploit::Remote::Ftp` mixin, leveraging recog to fingerprint targets from their banners. • Adds `resource` and `parents` fields to the `msf_service_info` MCP tool, `resource` to `msf_vulnerability_info`, `data` to `msf_note_info`, and `realm_key` / `realm_value` to `msf_credential_info`. • Adds four encoder variants for both RISC-V 32-bit and 64-bit little-endian architectures. • Adds `reverse_tcp` and `bind_tcp` stagers and a shell command stage for RISC-V 64-bit and 32-bit little-endian Linux targets. • Adds Windows on ARM (AArch64) reverse-TCP command-shell payload. • Adds Linux fetch multi payloads, a fetch server for FTP-based fetch payloads, and a TFTP server to `rex/proto`. • Adds a new persistence module `exploits/linux/persistence/apache_htaccess` that plants a mod_cgi `.htaccess` web shell on Linux Apache targets. • Adds an HTTP-to-SMB NTLM relay server module that relays incoming NTLM HTTP authentication requests to multiple SMB servers to establish SMB sessions. • Pro: Adds support for selecting Malleable C2 profiles from the single module run page, the payload generator, and the global persistent listeners page. • Pro: Adds multiple enhancements to the network topology page. • Pro: Adds a warning alert in the payload generator when `encoder/none` or `encoder/eicar` is selected. • Improves `scanner/ftp/ftp_version` to report the service when a host is up but no FTP banner is received. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/metasploit-pro https://docs.rapid7.com/insight/release-notes-5.0.0-2026061601 https://docs.rapid7.com/insight/release-notes-5.0.0-2026061601 Thu, 18 Jun 2026 00:00:00 GMT Metasploit Pro 5.0 introduces payloads_manager plugin, Kerberos tracing, and improved backup handling • Adds the `payloads_manager` plugin to maintain a local archive of custom payloads and stage them into the data directory • Introduces `KerberosTicketTrace` datastore option for Metasploit’s Kerberos authentication flows to view AS-REQ/REP messages • Adds multiple improvements to the backup functionality in Metasploit Pro, including better progress tracking and support for backups larger than 4GB Full history on Cyber Toolchain: https://cybertoolchain.io/tools/metasploit-pro https://docs.rapid7.com/insight/release-notes-5.0.0-2026051301 https://docs.rapid7.com/insight/release-notes-5.0.0-2026051301 Wed, 13 May 2026 00:00:00 GMT Metasploit Pro 5.0.0-2026051301 adds read-only MCP server and NTLM relay module • Adds a read-only MCP server for Metasploit capable of retrieving information from loaded modules and database. • Adds an NTLM relay module that relays from HTTP to LDAP, opening an authenticated LDAP session upon success. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/metasploit-pro https://docs.rapid7.com/insight/release-notes-5.0.0-2026042601 https://docs.rapid7.com/insight/release-notes-5.0.0-2026042601 Mon, 27 Apr 2026 00:00:00 GMT New persistence modules, HWBridge command execution, RISC-V fileless payloads, and improved module metadata performance • Adds new persistence module `exploit/windows/persistence/telemetry` that abuses the Windows Telemetry scheduled task to establish persistence. • Enables command execution for non-interactive HWBridge sessions via the `sessions -c` flag. • Adds a new payload `linux/loongarch64/chmod` to change file permissions on LoongArch64 targets. • Adds `riscv64le` and `riscv32le` architecture support to the fileless fetch payload adapter, enabling in-memory ELF execution via `memfd_create`. • Updates the network topology graph to show bruteforcible services present on a host. • Updates `db.hosts` RPC call to include comments associated with hosts. • Improves module metadata cache performance and reduces memory footprint for faster module listing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/metasploit-pro https://docs.rapid7.com/insight/release-notes-5.0.0-2026040201 https://docs.rapid7.com/insight/release-notes-5.0.0-2026040201 Fri, 03 Apr 2026 00:00:00 GMT Metasploit Pro 5.0 adds `OptTimedelta`, `DHCPEINTERFACE`, and new exploit modules including generic HTTP command exec. • Adds `LDAP::QuerySacl` datastore option to `ldap_query` module to control whether SACL queries are performed by default • Adds `OptTimedelta` datastore option type allowing time durations in human-friendly syntax for module authors and users • Adds new `exploits/multi/http/os_cmd_exec` module targeting generic HTTP command execution vulnerabilities • Adds `DHCPEINTERFACE` option to the DHCP server mixin allowing binding to a specific network interface Full history on Cyber Toolchain: https://cybertoolchain.io/tools/metasploit-pro https://docs.rapid7.com/insight/release-notes-4.22.9-2026030301 https://docs.rapid7.com/insight/release-notes-4.22.9-2026030301 Tue, 03 Mar 2026 00:00:00 GMT Metasploit Pro 4.22.9 adds GHSA/OSV references, child services reporting, GitLab service reports, default module options precedence, and social engineering tracking details. • Adds negative caching to the LDAP entry cache, recording missing objects by DN, sAMAccountName, or SID • Updates the single module run page to support default module options precedence: User Selection > Default Target Options > Payload Options • Enhances services to support child services for improved reporting (e.g., SSL -> HTTPS) • Adds reporting support for GitLab services • Adds MITRE ATT&CK tags and technique references to LDAP, AD CS, SMB account, SCCM, Windows password cracking, getsystem, cve_2020_1472_zerologon, and atlassian_confluence_rce_cve_2023_22527 modules • Adds support for GHSA (GitHub Security Advisories) and OSV (Open Source Vulnerabilities) references in modules • Allows Acunetix vulnerabilities to be imported without complete web page data • Updates social engineering campaign capabilities with details on email open tracking affected by auto-fetch or blocked tracking pixels Full history on Cyber Toolchain: https://cybertoolchain.io/tools/metasploit-pro https://docs.rapid7.com/insight/release-notes-4.22.9-2026020501 https://docs.rapid7.com/insight/release-notes-4.22.9-2026020501 Mon, 09 Feb 2026 00:00:00 GMT Metasploit Pro adds MITRE ATT&CK tags for Kerberos modules and enhances MongoBleed with new options • Adds MITRE ATT&CK metadata tags to modules related to Kerberos and unconstrained delegation, enabling content searches by ATT&CK technique ID. • Updates the MongoBleed auxiliary module to use the Wiz Magic Packet for quick detection, warn or halt if zlib is not enabled, reuse the MongoDB socket connection during memory scanning, and store extracted data in raw or JSON format. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/metasploit-pro https://docs.rapid7.com/insight/release-notes-4.22.9-2026011901 https://docs.rapid7.com/insight/release-notes-4.22.9-2026011901 Tue, 20 Jan 2026 00:00:00 GMT Metasploit Pro 4.22.9 adds KrbClockSkew option, Linux RISC-V payload support, and React2Shell/Waku improvements • Adds `KrbClockSkew` datastore option to Kerberos-authenticated modules for clock skew mitigation • Adds new bind shell and fetch payload support for Linux RISC-V targets • Adds register constants for aarch64, amd64, arm, loongarch64, mips32, mips64, ppc32, ppc64, riscv32, riscv64, and zarch architectures • Adds Waku framework support to the React2Shell module via modular configuration • Adds additional ATT&CK references to persistence modules Full history on Cyber Toolchain: https://cybertoolchain.io/tools/metasploit-pro https://docs.rapid7.com/insight/release-notes-4.22.9-2025121601 https://docs.rapid7.com/insight/release-notes-4.22.9-2025121601 Wed, 17 Dec 2025 00:00:00 GMT Metasploit Pro 4.22.9 adds ESC16 support, session re-running, MSSQL encryption, LoongArch64 payloads, and new NTLM/WSL persistence modules. • `AD CS MetaModule` now supports `ESC10`, `ESC16`, and `ESC9` certificate abuse chains • Adds the ability to re-run individual sessions using their previous configuration via the Pro interface • Adds a new NTLM relay module for relaying from SMB to MSSQL servers, opening an MSSQL session on success • Extends payload support to the `LoongArch64` architecture with a new reboot payload • Enables sessions to MSSQL servers that require encryption by adding a new `MsTds::Channel` for TLS negotiation • Adds a Windows persistence module targeting WSL, creating registry entries (`Run`, `RunOnce`) to run Linux payloads stored in WSL Breaking changes: • The `auxiliary/scanner/ssh/ssh_login_pubkey` module has been removed; functionality is now integrated into `auxiliary/scanner/ssh/ssh_login` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/metasploit-pro https://docs.rapid7.com/insight/release-notes-4.22.9-2025110601 https://docs.rapid7.com/insight/release-notes-4.22.9-2025110601 Fri, 07 Nov 2025 00:00:00 GMT Metasploit Pro 4.22.9 adds ReDoc detection, NCR RCE and Windows startup persistence modules; pro_tasks -a CLI flag • Adds new module #20594 for detecting publicly exposed ReDoc API documentation pages • Adds new unauthenticated RCE module #20650 for NCR Command Center Agent via malicious XML • Adds new persistence module #20662 for Windows startup folder (user or system-wide) • Adds support for aarch64 payloads to `exploit/multi/http/gitea_git_fetch_rce` (#20661) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/metasploit-pro https://docs.rapid7.com/insight/release-notes-4.22.8-2025102701 https://docs.rapid7.com/insight/release-notes-4.22.8-2025102701 Mon, 27 Oct 2025 00:00:00 GMT Metasploit Pro 4.22.8 adds new modules for Listmonk, MotionEye, Vvveb and Windows Script Host generation. • Adds auxiliary scanner module for insecure template function vulnerability in Listmonk (versions >= v4.0.0 and < v5.0.2) • Adds Windows fileformat module able to generate malicious Windows Script Host files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/metasploit-pro