Metasploit | Penetration Testing Software, Pen Testing Security

Knowledge is power, especially when it’s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.

Title	Date	Author
Land #20730, Allow toggling the SACL in LDAP queries # Release Notes This update modifies the ldap_query module to skip querying the SACL (System Access Control List) on security descriptors by default. This behavior is now controlled by a new option, LDAP::QuerySacl. This change is necessary when using a non-privileged user to query security descriptors via LDAP; otherwise, querying the SACL will cause the entire query to be blocked, resulting in no security descriptors being returned.	Mar 11, 2026	cdelafuente-r7
Revert "Land #20852, exposes encoder options for exploit and payloads" This reverts commit 96958dedbbccb88d545356fed5950911f6160a4f, reversing changes made to 8e03b6e98a094c8d1d54fba9489069f93ecd0cd9.	Mar 10, 2026	adfoster-r7
Revert "Land #21088, Fix base64 encoder" This reverts commit 437f7387547cb6f310b09a62b59de5b3360dd718, reversing changes made to e6ee6a7c94610e045fac6cddd5f5c391ea128c07.	Mar 10, 2026	adfoster-r7
Land #21001, adds module for SPIP Saisies plugin (CVE-2025-71243) Add SPIP Saisies plugin RCE module (CVE-2025-71243)	Mar 09, 2026	msutovsky-r7
Land #21017, adds module for SSTI in Tactical RMM (CVE-2025-69516) Add Tactical RMM Jinja2 SSTI RCE module (CVE-2025-69516)	Mar 05, 2026	msutovsky-r7
Land #20852, exposes encoder options for exploit and payloads Expose encoder options	Mar 04, 2026	msutovsky-r7

Title

Date

Author

Land #20730, Allow toggling the SACL in LDAP queries # Release Notes This update modifies the ldap_query module to skip querying the SACL (System Access Control List) on security descriptors by default. This behavior is now controlled by a new option, LDAP::QuerySacl. This change is necessary when using a non-privileged user to query security descriptors via LDAP; otherwise, querying the SACL will cause the entire query to be blocked, resulting in no security descriptors being returned.

Mar 11, 2026

cdelafuente-r7

Revert "Land #20852, exposes encoder options for exploit and payloads" This reverts commit 96958dedbbccb88d545356fed5950911f6160a4f, reversing changes made to 8e03b6e98a094c8d1d54fba9489069f93ecd0cd9.

Mar 10, 2026

adfoster-r7

Revert "Land #21088, Fix base64 encoder" This reverts commit 437f7387547cb6f310b09a62b59de5b3360dd718, reversing changes made to e6ee6a7c94610e045fac6cddd5f5c391ea128c07.

Mar 10, 2026

adfoster-r7

Land #21001, adds module for SPIP Saisies plugin (CVE-2025-71243) Add SPIP Saisies plugin RCE module (CVE-2025-71243)

Mar 09, 2026

msutovsky-r7

Land #21017, adds module for SSTI in Tactical RMM (CVE-2025-69516) Add Tactical RMM Jinja2 SSTI RCE module (CVE-2025-69516)

Mar 05, 2026

msutovsky-r7

Land #20852, exposes encoder options for exploit and payloads Expose encoder options

Mar 04, 2026

msutovsky-r7

Latest Pull Requests

Name	Labels	Author
Revert choose encoder updates		adfoster-r7
Fix base64 encoder	rn-fix	jbx81-1337
Add documentation for PayloadUUIDSeed global variable		Ganesh-abc
Revert "This adjusts module options that need a routable address"	rn-no-release-notes , additional-testing-required	adfoster-r7
Add KerberosTicketTrace support for AS/TGS/AP exchanges	additional-testing-required	eve0805
Update metasploit data models	rn-no-release-notes	adfoster-r7

Name

Labels

Author

Revert choose encoder updates

adfoster-r7

Fix base64 encoder

rn-fix

jbx81-1337

Add documentation for PayloadUUIDSeed global variable

Ganesh-abc

Revert "This adjusts module options that need a routable address"

rn-no-release-notes , additional-testing-required

adfoster-r7

Add KerberosTicketTrace support for AS/TGS/AP exchanges

additional-testing-required

eve0805

Update metasploit data models

rn-no-release-notes

adfoster-r7

Create a Pull Request

Recent Blog Posts

Thu Mar 12 2026

The Face of Penetration Testing is Changing: Announcing Metasploit Pro 5.0.0

The role and demand for red-teaming capabilities are growing, as more exploitable CVEs make their way into criminal hands. Being proactive is no longer a capability that can be reserved for annual tests, but a continuous asse...

Fri Mar 06 2026

Metasploit Wrap-Up 03/06/2026

Encoder exposed!Some of our releases add new ways in; this one adds new ways to stay in. There are, of course, still new RCE toys in the box (Tactical RMM via Jinja2 SSTI and an unauthenticated MajorDoMo exploit). Still, th...

Fri Feb 27 2026

Metasploit Wrap-Up 02/27/2026

No Prob-ollamaThis release brings some serious firepower with multiple new exploit modules and critical vulnerability support! The standout additions are the Ollama path traversal RCE (CVE-2024-37032), a sophisticated exploit...

View More Metasploit Blog Posts