Metasploit | Penetration Testing Software, Pen Testing Security

Knowledge is power, especially when it’s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.

Title	Date	Author
Land #20999, removes older persistence module Remove obsolete windows/local/persistence in favor of windows/persistence/registry	Mar 31, 2026	msutovsky-r7
Land #21029, adds module for Grav CMS (CVE-2025-50286) Adds exploit module for Grav CMS (CVE-2025-50286)	Mar 31, 2026	msutovsky-r7
Land #20835, adds module unauthenticated command injection Eclipse Che machine-exec (CVE-2025-12548) Add Eclipse Che machine-exec unauthenticated RCE (CVE-2025-12548)	Mar 25, 2026	msutovsky-r7
Land #20719, adds module for authenticated command injection in FreePBX filestore (CVE-2025-64328) Add authenticated RCE module for FreePBX filestore (CVE-2025-64328)	Mar 13, 2026	msutovsky-r7
Land #20730, Allow toggling the SACL in LDAP queries # Release Notes This update modifies the ldap_query module to skip querying the SACL (System Access Control List) on security descriptors by default. This behavior is now controlled by a new option, LDAP::QuerySacl. This change is necessary when using a non-privileged user to query security descriptors via LDAP; otherwise, querying the SACL will cause the entire query to be blocked, resulting in no security descriptors being returned.	Mar 11, 2026	cdelafuente-r7

Title

Date

Author

Land #20999, removes older persistence module Remove obsolete windows/local/persistence in favor of windows/persistence/registry

Mar 31, 2026

msutovsky-r7

Land #21029, adds module for Grav CMS (CVE-2025-50286) Adds exploit module for Grav CMS (CVE-2025-50286)

Mar 31, 2026

msutovsky-r7

Land #20835, adds module unauthenticated command injection Eclipse Che machine-exec (CVE-2025-12548) Add Eclipse Che machine-exec unauthenticated RCE (CVE-2025-12548)

Mar 25, 2026

msutovsky-r7

Land #20719, adds module for authenticated command injection in FreePBX filestore (CVE-2025-64328) Add authenticated RCE module for FreePBX filestore (CVE-2025-64328)

Mar 13, 2026

msutovsky-r7

Land #20730, Allow toggling the SACL in LDAP queries # Release Notes This update modifies the ldap_query module to skip querying the SACL (System Access Control List) on security descriptors by default. This behavior is now controlled by a new option, LDAP::QuerySacl. This change is necessary when using a non-privileged user to query security descriptors via LDAP; otherwise, querying the SACL will cause the entire query to be blocked, resulting in no security descriptors being returned.

Mar 11, 2026

cdelafuente-r7

Latest Pull Requests

Name	Labels	Author
Fix flakey rspec tests	rn-no-release-notes	adfoster-r7
Update cache sizes for bash payloads	easy , rn-no-release-notes	adfoster-r7
Contact Form by Supsystic Wordpress Plugin exploit CVE-2026-4257	module	bootstrapbool
Update nmap_document to properly import hostnames from nmap scans	additional-testing-required	golem445
DO NOT MERGE: glue code for win64, runpe		dledda-r7
Update metasploit-payloads to 2.0.245	payload , rn-payload-enhancement	bwatters-r7

Name

Labels

Author

Fix flakey rspec tests

rn-no-release-notes

adfoster-r7

Update cache sizes for bash payloads

easy , rn-no-release-notes

adfoster-r7

Contact Form by Supsystic Wordpress Plugin exploit CVE-2026-4257

module

bootstrapbool

Update nmap_document to properly import hostnames from nmap scans

additional-testing-required

golem445

DO NOT MERGE: glue code for win64, runpe

dledda-r7

Update metasploit-payloads to 2.0.245

payload , rn-payload-enhancement

bwatters-r7

Create a Pull Request

Recent Blog Posts

Fri Apr 10 2026

Metasploit Wrap-Up 04/10/2026

Speedup Improvements of MSFVenom & New ModulesThis week, we have added new modules to Metasploit Framework targeting Cisco Catalyst SD-WAN controllers and osTicket as well as updates and improvements to Windows service-for-us...

Fri Apr 03 2026

Metasploit Wrap-Up 04/03/2026

Additional Adapters and More ModulesThis week, we added a whole new bunch of HTTP/HTTPS-based CMD payloads for X64 and X86 versions of Windows. The additional breadth of selectable payloads and delivery techniques allows user...

Fri Mar 27 2026

Metasploit Wrap-Up 03/27/2026

Better NTLM Relaying FunctionalityThis week’s release brings an improvement to the SMB NTLM relay server. In the past, it’s support has been expanded with modules for relaying to HTTP (ESC8), MSSQL and LDAP while still receiv...

View More Metasploit Blog Posts