Metasploit has released a significant update, introducing thirteen new modules that address a variety of vulnerabilities, including several remote code execution (RCE) flaws. The update also brings enhancements to the framework's capabilities, such as support for HTTP malleable profiles and improved functionality for Windows on ARM architectures.
Among the newly added RCE modules is one targeting Pterodactyl Panel versions prior to 1.11.11 (CVE-2025-49132). This exploit leverages a path traversal vulnerability in the `locale.json` endpoint, allowing unauthenticated attackers to create arbitrary files and achieve RCE in the context of the web server user.
Another critical RCE module focuses on the SonicWall SMA1000 WorkPlace wsproxy service, exploiting a Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-15409.
For WordPress users, two new RCE modules have been introduced. One targets the WP2Shell vulnerability (CVE-2026-60137), affecting WordPress core versions 6.9.0–6.9.4 and 7.0.0–7.0.1. This module chains a REST API route confusion flaw (CVE-2026-63030) with an SQL injection to elevate privileges, deploy a custom plugin payload, and execute a remote session. The second WordPress module exploits an unauthenticated RCE vulnerability (CVE-2026-3891) found in the Pix for WooCommerce plugin.
The update also includes an exploit module for Ghost CMS (CVE-2026-29053), which achieves RCE by uploading a malicious theme. This vulnerability arises from the theme renderer's evaluation of untrusted JSONPath expressions through the `{{#get}}` helper, allowing for arbitrary code injection. Successful exploitation requires valid admin or staff credentials.
Joomla Content Editor (JCE) extension versions up to and including 2.9.99.4 are affected by a new unauthenticated file upload RCE module (CVE-2026-48907). This vulnerability allows attackers to import a crafted profile due to a lack of authentication enforcement in the `profiles.import` task, leading to the creation of a PHP web shell and subsequent RCE if the `tmp/` directory is directly accessible.
Other RCE modules include one for Langflow versions prior to 1.9.0 (CVE-2026-33017), exploiting an unauthenticated RCE vulnerability in the `/api/v1/build_public_tmp/{flow_id}/flow` endpoint, and an exploit for OpenCATS targeting a PHP code injection vulnerability (CVE-2026-27760) during installation.
A local privilege escalation (LPE) module, dubbed Fragnesia (CVE-2026-46300), has been added. This exploit targets a page-cache replacement vulnerability within the Linux kernel's XFRM (IPsec) subsystem.
Beyond RCEs and LPEs, a new auxiliary module leverages a path traversal vulnerability in Ray Dashboard's Logs API to list local directory contents. A CVE for this specific Ray Dashboard issue is currently pending assignment.
Metasploit's framework itself has received several upgrades. All Meterpreter payloads, including those for Windows, Java, Python, PHP, and Linux, now support a new `MALLEABLEC2` option. This feature allows users to load standard profiles into Meterpreter to modify the appearance of its HTTP(S) traffic.
Significantly, Windows on ARM (AArch64) now has first-class support with the addition of both inline and staged reverse-TCP command-shell payloads.
Further enhancements include improvements to the FTP login scanner and version reporting, fixes for `msfconsole` crashes when the database is missing, and extended CertificateTrace peer certificate tracing to support LDAP over TLS, RDP, and PostgreSQL over TLS. Bearer Authentication has also been added to the MCP server plugin.
