Metasploit | Penetration Testing Software, Pen Testing Security

Knowledge is power, especially when it’s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.

Title	Date	Author
Land #21497, adds authenticated arbitrary OS command injection in Activemq jolokia (CVE-2026-34197) Activemq jolokia exploit (CVE-2026-34197)	May 29, 2026	msutovsky-r7
Land #21504, adds CVE numbers to modules add CVEs to modules	May 27, 2026	msutovsky-r7
Land #21506, adds guard for wsl_startup_folder persistence guard wsl startup_folder persistence	May 27, 2026	msutovsky-r7
Land #21434, adds Dirtyfrag privilege escalation modules (CVE-2026-43284, CVE-2026-43500) Dirty Frag Linux Local Privilege Escalation (CVE-2026-43284)(CVE-2026-43500)	May 21, 2026	msutovsky-r7
Land #21155, adds exploit module for Dompdf (CVE-2022-28368) Add exploit module for Dompdf RCE (CVE-2022-28368)	May 21, 2026	msutovsky-r7
Land #21035, adds module for arbitrary code execution in Barracuda ESG (CVE-2023-7102) Add Barracuda ESG Spreadsheet::ParseExcel RCE exploit (CVE-2023-7102)	May 19, 2026	msutovsky-r7

Title

Date

Author

Land #21497, adds authenticated arbitrary OS command injection in Activemq jolokia (CVE-2026-34197) Activemq jolokia exploit (CVE-2026-34197)

May 29, 2026

msutovsky-r7

Land #21504, adds CVE numbers to modules add CVEs to modules

May 27, 2026

msutovsky-r7

Land #21506, adds guard for wsl_startup_folder persistence guard wsl startup_folder persistence

May 27, 2026

msutovsky-r7

Land #21434, adds Dirtyfrag privilege escalation modules (CVE-2026-43284, CVE-2026-43500) Dirty Frag Linux Local Privilege Escalation (CVE-2026-43284)(CVE-2026-43500)

May 21, 2026

msutovsky-r7

Land #21155, adds exploit module for Dompdf (CVE-2022-28368) Add exploit module for Dompdf RCE (CVE-2022-28368)

May 21, 2026

msutovsky-r7

Land #21035, adds module for arbitrary code execution in Barracuda ESG (CVE-2023-7102) Add Barracuda ESG Spreadsheet::ParseExcel RCE exploit (CVE-2023-7102)

May 19, 2026

msutovsky-r7

Latest Pull Requests

Name	Labels	Author
Update the Attic label definition	docs , rn-no-release-notes	jheysel-r7
Update --help-formats and --payload-options flags in Docs	docs , easy , rn-fix	orbit-bot
guard wsl startup_folder persistence	bug , easy , rn-fix	h00die
add CVEs to modules	rn-enhancement	h00die
fix snmp enum bug/crash in null system_date	bug	h00die
Update LicenseFinder	rn-no-release-notes	adfoster-r7

Name

Labels

Author

Update the Attic label definition

docs , rn-no-release-notes

jheysel-r7

Update --help-formats and --payload-options flags in Docs

docs , easy , rn-fix

orbit-bot

guard wsl startup_folder persistence

bug , easy , rn-fix

h00die

add CVEs to modules

rn-enhancement

h00die

fix snmp enum bug/crash in null system_date

bug

h00die

Update LicenseFinder

rn-no-release-notes

adfoster-r7

Create a Pull Request

Recent Blog Posts

Fri May 29 2026

Metasploit Wrap Up 05/29/2026

More Linux LPEsHark the age of the Linux LPE has arrived. This week’s release follows up on recent work bringing new Linux LPEs to Metasploit users. Copy Fail seemed to have kicked off a trend of similar bugs and hot on its h...

Fri May 22 2026

Metasploit Wrap Up 05/22/2026

Another week, another authentication bypassOur humble Metasploit weekly(ish) blog has been blessed with a new network component vulnerability. The dynamic duo of @sfewer-r7 and @jburgess-r7 have discovered and authored the ad...

Fri May 15 2026

Metasploit Wrap-Up 05/15/2026

Weaponizing a text editor for fun and profitGather round, dear readers, because today, we (by we, we mean @h00die) dropped the ultimate persistence mechanism: Vim plugin persistence. And honestly, calling it "persistence" fee...

View More Metasploit Blog Posts