Metasploit Wrap Up: This One Goes to Sixteen!
Metasploit adds 16 modules including 10 exploits, five covering CISA KEV vulnerabilities in Cisco, SonicWall, PaperCut, JetBrains and Langflow.
Rapid7's weekly Metasploit update ships 16 new modules, 10 of them exploit modules, with five targeting CISA KEV entries. New exploits cover Cisco Secure Firewall Management Center auth bypass (CVE-2026-20079), a SonicWall SMA1000 SSRF-to-root RCE chain (CVE-2026-83548/CVE-2026-83549), JetBrains TeamCity deserialization RCE (CVE-2026-63077), PaperCut NG/MF chain (CVE-2026-81578/CVE-2026-82078), and Langflow authenticated RCE (CVE-2026-19295). The SonicWall and PaperCut chains were reported as actively exploited zero-days, and a new ESC8 relay module exploits CVE-2026-20929 against AD CS Web Enrollment.
- 16 new modules, 10 of them exploit modules, 5 targeting CISA KEV
- SonicWall SMA1000 and PaperCut chains were actively exploited zero-days
- New ESC8 Kerberos relay module exploits CVE-2026-20929
- TeamCity RCE abuses unsafe XStream deserialization in agent polling
- New auxiliary scanner detects Metasploit reverse handler ports
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-54988 | Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML… | 8.4 | 15% | ||
| CVE-2025-66516 | Critical XXE in Apache Tika PDF parsing via crafted XFA forms | 9.8 | 80% | ||
| CVE-2026-19295 | Authenticated OS command injection in IBM Langflow OSS | 9.9 | <1% | ||
| CVE-2026-20079 | Authentication bypass to root access in Cisco Secure Firewall Management Center | 10.0 | 89% | KEVPoC ×2 | KEV |
| CVE-2026-20929 | Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network | 7.5 | 1% | ||
| CVE-2026-23744 | Unauthenticated RCE in MCPJam Inspector via crafted HTTP requests | 9.8 | 68% | PoC ×3 | |
| CVE-2026-63077 | Unauthenticated Deserialization RCE in JetBrains TeamCity On-Premises | 9.8 | 94% | KEVRansomwarePoC | KEV |
CVE-2026-82078+1 related CVE | Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks | 9.4 group max | 63% | KEV | KEV |
CVE-2026-83548+1 related CVE | Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface | 10.0 group max | 8% | KEVPoC ×3 | KEV |
From the original article
5 min read at rapid7.com
This One Goes to Sixteen! Another banger from Metasploit with sixteen new modules, including ten exploit modules, with five on the CISA KEV list. Cisco, Papercut, Sonicwall, Jetbrains, and Langflow all have exploit modules, and not to be outdone, we even have a Metasploit scanner to watch the watchers!
By Brendan Watters · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.