Metasploit | Penetration Testing Software, Pen Testing Security

Knowledge is power, especially when it’s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.

Title	Date	Author
Land #21465, adds VSCode extension persistence module VS Code extension persistence	Jun 11, 2026	msutovsky-r7
Land #21008, adds kernel_rex_version for parsing kernel version to Rex format Add kernel_rex_version for kernel parsing	Jun 11, 2026	msutovsky-r7
Land #21497, adds authenticated arbitrary OS command injection in Activemq jolokia (CVE-2026-34197) Activemq jolokia exploit (CVE-2026-34197)	May 29, 2026	msutovsky-r7
Land #21504, adds CVE numbers to modules add CVEs to modules	May 27, 2026	msutovsky-r7
Land #21506, adds guard for wsl_startup_folder persistence guard wsl startup_folder persistence	May 27, 2026	msutovsky-r7
Land #21434, adds Dirtyfrag privilege escalation modules (CVE-2026-43284, CVE-2026-43500) Dirty Frag Linux Local Privilege Escalation (CVE-2026-43284)(CVE-2026-43500)	May 21, 2026	msutovsky-r7

Title

Date

Author

Land #21465, adds VSCode extension persistence module VS Code extension persistence

Jun 11, 2026

msutovsky-r7

Land #21008, adds kernel_rex_version for parsing kernel version to Rex format Add kernel_rex_version for kernel parsing

Jun 11, 2026

msutovsky-r7

Land #21497, adds authenticated arbitrary OS command injection in Activemq jolokia (CVE-2026-34197) Activemq jolokia exploit (CVE-2026-34197)

May 29, 2026

msutovsky-r7

Land #21504, adds CVE numbers to modules add CVEs to modules

May 27, 2026

msutovsky-r7

Land #21506, adds guard for wsl_startup_folder persistence guard wsl startup_folder persistence

May 27, 2026

msutovsky-r7

Land #21434, adds Dirtyfrag privilege escalation modules (CVE-2026-43284, CVE-2026-43500) Dirty Frag Linux Local Privilege Escalation (CVE-2026-43284)(CVE-2026-43500)

May 21, 2026

msutovsky-r7

Latest Pull Requests

Name	Labels	Author
Fixed issue #21572 - Catch NoDatabaseError on msfconsole exit		arpan-pramanik
Exclude deleted files from modified files list	rn-fix	dwelch-r7
Fix undefined call to ArmBE to_linux_armbe_elf	rn-fix	sjanusz-r7
Fix SMB version crash on smb1	rn-fix	adfoster-r7
enforce authentication in API tests and improve error handling for unauthenticated requests	bug , rn-no-release-notes	dwelch-r7
Fix db_import crash	tests , rn-fix	adfoster-r7

Name

Labels

Author

Fixed issue #21572 - Catch NoDatabaseError on msfconsole exit

arpan-pramanik

Exclude deleted files from modified files list

rn-fix

dwelch-r7

Fix undefined call to ArmBE to_linux_armbe_elf

rn-fix

sjanusz-r7

Fix SMB version crash on smb1

rn-fix

adfoster-r7

enforce authentication in API tests and improve error handling for unauthenticated requests

bug , rn-no-release-notes

dwelch-r7

Fix db_import crash

tests , rn-fix

adfoster-r7

Create a Pull Request

Recent Blog Posts

Fri Jun 19 2026

Weekly Metasploit Update: NTLM Relay Priv Esc, MCP Server Integration, Paperclip AI RCE Chain, and more

This week's release includes five new modules, including a full unauthenticated RCE chain for Paperclip AI and a VS Code extension persistence technique. On the post-exploitation side, the new windows/local/ntlm_relay_2_self ...

Sat Jun 13 2026

Weekly Metasploit Update: New Kerberos/Certificate tracing options, and multiple new modules

New Tracing OptionsAs hard as we try to ensure that Metasploit is bug free, issues inevitably come up. Whether you’re running a module on an op or writing a new one, what we can do is make the debugging experience easier. To ...

Fri Jun 05 2026

Weekly Metasploit Update: Apache ActiveMQ RCE, Gogs Rebase RCE, and Windows Kernel Pointer Enum

When Open Source is a bit too OpenSeveral fun modules landed this week, including an Apache RCE, Windows Kernel pointer collection, and Gogs RCE via naming. Leading off is Gogs' RCE that allows an attacker to execute commands...

View More Metasploit Blog Posts