A recent update to the Metasploit framework has introduced sixteen new modules, including ten exploit modules, five of which address vulnerabilities listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. The new exploits target products from Cisco, PaperCut, SonicWall, JetBrains, and Langflow, among others.
One of the significant additions is an exploit module for CVE-2026-20079, an unauthenticated authentication bypass vulnerability affecting Cisco Secure Firewall Management Center (FMC). This allows for remote code execution (RCE) on vulnerable systems.
For SonicWall SMA1000, a new module addresses a chain of zero-day exploits (CVE-2026-83548, SMA1000-9427, and CVE-2026-83549) that were reportedly exploited in the wild in early September. This chain leverages a server-side request forgery (SSRF) to bypass authentication, an RCE with low privileges via CouchDB read/write primitives, and a command injection in `cmsSnmpTrap.sh` for root-level RCE. SonicWall has confirmed that version 12.5.0-02952 remediates this exploit chain.
JetBrains TeamCity is also targeted with a new unauthenticated RCE exploit module, CVE-2026-63077. This vulnerability stems from an unsafe XStream deserialization flaw within the agent polling protocol, enabling the execution of a one-shot JSP payload on the server. The module supports both Windows and Linux targets and includes cleanup logic to remove the fake build agent created during exploitation.
PaperCut NG/MF is affected by an exploit chain (CVE-2026-81578 and CVE-2026-82078) that was reported as a zero-day actively exploited in the wild. A new Metasploit module has been added to exploit these vulnerabilities, which lead to unauthenticated RCE.
Other notable exploit modules include CVE-2026-19295, an authenticated RCE vulnerability in Langflow versions 1.10.0 and below, and CVE-2026-23744, an unauthenticated command execution vulnerability in MCPJam Inspector via the `/api/mcp/connect` endpoint. The latter allows remote attackers to execute operating system commands by manipulating a JSON `serverConfig` object.
SimpleHelp versions 5.5.0 through 5.5.15 are vulnerable to CVE-2026-48558, an OIDC authentication bypass leading to remote code execution. Additionally, an unauthenticated RCE vulnerability in SPIP versions up to 4.4.21, affecting the forum autosave session handler, has been added. This allows arbitrary PHP code storage in a session variable, which is then executed by the template engine. No CVE has been assigned to the SPIP autosave vulnerability yet.
Next.js applications hosted on Windows servers are susceptible to CVE-2026-75604, an RCE vulnerability affecting versions 13.4.0 through 15.5.24, and 16.0.0 through 16.3.3. This allows for arbitrary code execution through specially crafted requests.
Beyond exploits, the update also features several auxiliary and evasion modules. These include a scanner for CVE-2025-54988/CVE-2025-66516, an XML External Entity (XXE) vulnerability in Apache Tika's XFA parser exposed through the Elasticsearch attachment ingest processor. Another auxiliary module addresses a blind SQL injection in SPIP's date column escaping logic. A new scanner module can detect Metasploit reverse handlers on target ports, identifying the type of shell they would deliver.
An auxiliary module, `esc8_kerberos`, leverages CVE-2026-20929 to exploit AD CS Web Enrollment (ESC8). This module captures an SMB2 AP-REQ from a coerced client and replays the authentication to the target certificate server over HTTP, allowing an attacker to obtain a certificate for the victim and a valid Kerberos TGT without credentials. An evasion module for Linux x64 environments performs runtime checks to detect sandboxes or virtual machines and aborts execution if detected.
Finally, two new Windows persistence modules have been added: one leveraging the `BootVerificationProgram` registry key and another registering a custom Time Provider DLL.
