Metasploit | Penetration Testing Software, Pen Testing Security

Knowledge is power, especially when it’s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.

Title	Date	Author
Land #19821, adds Burpsuite persistence module Burp extension persistence	Jan 22, 2026	msutovsky-r7
Land #20806, adds module for unauthenticated command injection in Control Web Panel API (CVE-2025-67888) Adds module for Control Web Panel API Command Injection (CVE-2025-67888)	Jan 14, 2026	msutovsky-r7
Land #20810, adds module for authenticated RCE in n8n (CVE-2025-68613) Adds module for n8n workflow expression RCE (CVE-2025-68613)	Jan 13, 2026	msutovsky-r7
Land #20796, moves udev module into persistence category update udev to persistence mixin	Jan 09, 2026	msutovsky-r7
Land #20811, adds module for Prison Management System 1.0 RCE (CVE-2024-48594) Add Prison Management System 1.0 auth RCE (CVE-2024-48594)	Jan 08, 2026	msutovsky-r7
Land #20700, adds module for Taiga.io RCE (CVE-2025-62368) Adds exploit module for authenticated deserialization vulnerability in Taiga.io (CVE-2025-62368)	Jan 07, 2026	msutovsky-r7

Title

Date

Author

Land #19821, adds Burpsuite persistence module Burp extension persistence

Jan 22, 2026

msutovsky-r7

Land #20806, adds module for unauthenticated command injection in Control Web Panel API (CVE-2025-67888) Adds module for Control Web Panel API Command Injection (CVE-2025-67888)

Jan 14, 2026

msutovsky-r7

Land #20810, adds module for authenticated RCE in n8n (CVE-2025-68613) Adds module for n8n workflow expression RCE (CVE-2025-68613)

Jan 13, 2026

msutovsky-r7

Land #20796, moves udev module into persistence category update udev to persistence mixin

Jan 09, 2026

msutovsky-r7

Land #20811, adds module for Prison Management System 1.0 RCE (CVE-2024-48594) Add Prison Management System 1.0 auth RCE (CVE-2024-48594)

Jan 08, 2026

msutovsky-r7

Land #20700, adds module for Taiga.io RCE (CVE-2025-62368) Adds exploit module for authenticated deserialization vulnerability in Taiga.io (CVE-2025-62368)

Jan 07, 2026

msutovsky-r7

Latest Pull Requests

Name	Labels	Author
Fixes the base service authenticator for BadSuccessor	rn-fix	jheysel-r7
Fix specs issue due to a missing `KrbClockSkew` option	tests , bug , rn-no-release-notes	cdelafuente-r7
Fix Kerberos Base Service Authenticator	rn-fix	jheysel-r7
Add more specific error messages	easy , rn-no-release-notes	zeroSteiner
Resolve method undefined issue	rn-no-release-notes	adfoster-r7
Update bad successor description	rn-no-release-notes	adfoster-r7

Name

Labels

Author

Fixes the base service authenticator for BadSuccessor

rn-fix

jheysel-r7

Fix specs issue due to a missing `KrbClockSkew` option

tests , bug , rn-no-release-notes

cdelafuente-r7

Fix Kerberos Base Service Authenticator

rn-fix

jheysel-r7

Add more specific error messages

easy , rn-no-release-notes

zeroSteiner

Resolve method undefined issue

rn-no-release-notes

adfoster-r7

Update bad successor description

rn-no-release-notes

adfoster-r7

Create a Pull Request

Recent Blog Posts

Fri Jan 23 2026

Metasploit Wrap-Up 01/23/2026

Oracle E-Business Suite Unauth RCEThis week, we are pleased to announce the addition of a module that exploits CVE-2025-61882, a pre-authentication remote code execution vulnerability in Oracle E-Business Suite versions 12.2....

Fri Jan 16 2026

Metasploit Wrap-Up 01/16/2026

Persistence, dMSA Abuse & RCE GoodiesThis week, we have received a lot of contributions from the community, such as h00die, Chocapikk and countless others, which is greatly appreciated. This week’s modules and improvements in...

Fri Jan 09 2026

Metasploit Wrap-Up 01/09/2026

RISC-V PayloadsThis week brings more RISC-V payloads from community member bcoles. One provides a new adapter which allows RISC-V payloads to be converted to commands and delivered as a Metasploit fetch-payload. The second is...

View More Metasploit Blog Posts