Metasploit | Penetration Testing Software, Pen Testing Security

Knowledge is power, especially when it’s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.

Title	Date	Author
Land #20951, moves default payload into more consistent default options Moves default payload into default options in Remote for Mac module	Feb 25, 2026	msutovsky-r7
Land #20978, adds module BeyondTrust unauth command injection (CVE-2026-1731) Add CVE-2026-1731 support and modernize targets for BeyondTrust PRA/R…	Feb 25, 2026	msutovsky-r7
Land #21006, adds module for Ollama path traversal RCE (CVE-2024-37032) Add Ollama path traversal RCE module (CVE-2024-37032)	Feb 25, 2026	msutovsky-r7
Land #20819, adds WSL startup folder persistence module wsl startup folder persistence	Feb 24, 2026	msutovsky-r7
Land #20841, adds persistence module for Windows feature active setup active setup persistence	Feb 20, 2026	msutovsky-r7
Land #20976, adds module for StoryChief WP plugin (CVE-2025-7441) Add StoryChief WordPress 1.0.42 unauthenticated RCE module (CVE-2025-7441)	Feb 19, 2026	msutovsky-r7

Title

Date

Author

Land #20951, moves default payload into more consistent default options Moves default payload into default options in Remote for Mac module

Feb 25, 2026

msutovsky-r7

Land #20978, adds module BeyondTrust unauth command injection (CVE-2026-1731) Add CVE-2026-1731 support and modernize targets for BeyondTrust PRA/R…

Feb 25, 2026

msutovsky-r7

Land #21006, adds module for Ollama path traversal RCE (CVE-2024-37032) Add Ollama path traversal RCE module (CVE-2024-37032)

Feb 25, 2026

msutovsky-r7

Land #20819, adds WSL startup folder persistence module wsl startup folder persistence

Feb 24, 2026

msutovsky-r7

Land #20841, adds persistence module for Windows feature active setup active setup persistence

Feb 20, 2026

msutovsky-r7

Land #20976, adds module for StoryChief WP plugin (CVE-2025-7441) Add StoryChief WordPress 1.0.42 unauthenticated RCE module (CVE-2025-7441)

Feb 19, 2026

msutovsky-r7

Latest Pull Requests

Name	Labels	Author
Add AD CS Web Enrollment certificate issuance module with HttpCliet a…		erdragone430
Fix crash when running ldap esc vulnerable cert finder	rn-enhancement	adfoster-r7
Improve graphql introspection detection scanner	rn-fix	adfoster-r7
Add support for printing module name prefix	rn-no-release-notes	adfoster-r7
Update Gitlab mixin logs	enhancement , rn-enhancement	Nayeraneru
Add Kerberos authentication support to SCCM mixin	enhancement , rn-enhancement	erdragone430

Name

Labels

Author

Add AD CS Web Enrollment certificate issuance module with HttpCliet a…

erdragone430

Fix crash when running ldap esc vulnerable cert finder

rn-enhancement

adfoster-r7

Improve graphql introspection detection scanner

rn-fix

adfoster-r7

Add support for printing module name prefix

rn-no-release-notes

adfoster-r7

Update Gitlab mixin logs

enhancement , rn-enhancement

Nayeraneru

Add Kerberos authentication support to SCCM mixin

enhancement , rn-enhancement

erdragone430

Create a Pull Request

Recent Blog Posts

Fri Feb 27 2026

Metasploit Wrap-Up 02/27/2026

No Prob-ollamaThis release brings some serious firepower with multiple new exploit modules and critical vulnerability support! The standout additions are the Ollama path traversal RCE (CVE-2024-37032), a sophisticated exploit...

Fri Feb 20 2026

Metasploit Wrap-Up 02/20/2026

Hacking Churches and Backdooring EmacsThis release packs some solid exploit module additions! Two new unauthenticated RCE modules are a major win: the StoryChief WordPress plugin exploit (CVE-2025-7441) targets a webhook vali...

Fri Feb 13 2026

Metasploit Wrap-Up 02/13/2026

SolarWinds Web Help DeskOur very own sfewer-r7 has developed an exploit module for the SolarWinds Web Help Desk vulnerabilities CVE-2025-40536 and CVE-2025-40551. On successful exploitation the session will be as running as N...

View More Metasploit Blog Posts