Metasploit | Penetration Testing Software, Pen Testing Security

Knowledge is power, especially when it’s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.

Title	Date	Author
Land #21465, adds VSCode extension persistence module VS Code extension persistence	Jun 11, 2026	msutovsky-r7
Land #21008, adds kernel_rex_version for parsing kernel version to Rex format Add kernel_rex_version for kernel parsing	Jun 11, 2026	msutovsky-r7
Land #21497, adds authenticated arbitrary OS command injection in Activemq jolokia (CVE-2026-34197) Activemq jolokia exploit (CVE-2026-34197)	May 29, 2026	msutovsky-r7
Land #21504, adds CVE numbers to modules add CVEs to modules	May 27, 2026	msutovsky-r7
Land #21506, adds guard for wsl_startup_folder persistence guard wsl startup_folder persistence	May 27, 2026	msutovsky-r7
Land #21434, adds Dirtyfrag privilege escalation modules (CVE-2026-43284, CVE-2026-43500) Dirty Frag Linux Local Privilege Escalation (CVE-2026-43284)(CVE-2026-43500)	May 21, 2026	msutovsky-r7

Title

Date

Author

Land #21465, adds VSCode extension persistence module VS Code extension persistence

Jun 11, 2026

msutovsky-r7

Land #21008, adds kernel_rex_version for parsing kernel version to Rex format Add kernel_rex_version for kernel parsing

Jun 11, 2026

msutovsky-r7

Land #21497, adds authenticated arbitrary OS command injection in Activemq jolokia (CVE-2026-34197) Activemq jolokia exploit (CVE-2026-34197)

May 29, 2026

msutovsky-r7

Land #21504, adds CVE numbers to modules add CVEs to modules

May 27, 2026

msutovsky-r7

Land #21506, adds guard for wsl_startup_folder persistence guard wsl startup_folder persistence

May 27, 2026

msutovsky-r7

Land #21434, adds Dirtyfrag privilege escalation modules (CVE-2026-43284, CVE-2026-43500) Dirty Frag Linux Local Privilege Escalation (CVE-2026-43284)(CVE-2026-43500)

May 21, 2026

msutovsky-r7

Latest Pull Requests

Name	Labels	Author
enforce authentication in API tests and improve error handling for unauthenticated requests	bug , rn-no-release-notes	dwelch-r7
Fix db_import crash	tests , rn-fix	adfoster-r7
Make WebDAV upload PHP exploit checks less strict	rn-enhancement	sjanusz-r7
fix: add CVE-1999-0512 reference to smtp_relay module	rn-fix	4ravind-b
Paperclip unauthenticated RCE [CVE-2026-41679]	module , docs , rn-modules	h00die-gr3y
docs: replace deprecated msfpayload/msfencode references with msfvenom	docs	sucloudflare

Name

Labels

Author

enforce authentication in API tests and improve error handling for unauthenticated requests

bug , rn-no-release-notes

dwelch-r7

Fix db_import crash

tests , rn-fix

adfoster-r7

Make WebDAV upload PHP exploit checks less strict

rn-enhancement

sjanusz-r7

fix: add CVE-1999-0512 reference to smtp_relay module

rn-fix

4ravind-b

Paperclip unauthenticated RCE [CVE-2026-41679]

module , docs , rn-modules

h00die-gr3y

docs: replace deprecated msfpayload/msfencode references with msfvenom

docs

sucloudflare

Create a Pull Request

Recent Blog Posts

Sat Jun 13 2026

Weekly Metasploit Update: New Kerberos/Certificate tracing options, and multiple new modules

New Tracing OptionsAs hard as we try to ensure that Metasploit is bug free, issues inevitably come up. Whether you’re running a module on an op or writing a new one, what we can do is make the debugging experience easier. To ...

Fri Jun 05 2026

Weekly Metasploit Update: Apache ActiveMQ RCE, Gogs Rebase RCE, and Windows Kernel Pointer Enum

When Open Source is a bit too OpenSeveral fun modules landed this week, including an Apache RCE, Windows Kernel pointer collection, and Gogs RCE via naming. Leading off is Gogs' RCE that allows an attacker to execute commands...

Fri May 29 2026

Metasploit Wrap Up 05/29/2026

More Linux LPEsHark the age of the Linux LPE has arrived. This week’s release follows up on recent work bringing new Linux LPEs to Metasploit users. Copy Fail seemed to have kicked off a trend of similar bugs and hot on its h...

View More Metasploit Blog Posts