Metasploit adds unauthenticated RCE modules for perimeter devices
Original title: Metasploit Wrapup: Unauth RCE modules in Network Perimeter Devices and much more
New modules cover Flowise, SPIP, OpenBullet2, GitLab, Portainer, and a NetScaler bug the vendor said was exploited.
Rapid7's Metasploit weekly release adds 13 modules, including unauthenticated remote code execution against Citrix NetScaler and other perimeter targets, plus an authenticated GitLab CI/CD integer-overflow module. Auxiliary modules cover a Flowise authentication bypass, a SPIP password-reset IDOR, a Consul version scanner, and OpenBullet2 NTLMv2 hash disclosure. The NetScaler command-injection issue was reported as exploited in the wild before disclosure. Fetch payloads now include LoongArch.
Unconfirmed: The NetScaler write-up names CVE-2026-88771 in the title and CVE-2026-88773 in the CVE field without explaining the difference.
- Flowise 3.0.5 and earlier return a password-reset token (CVE-2025-58434).
- SPIP before 4.4.23 allows password changes; fixed in 4.4.23, no CVE yet.
- OpenBullet2 from 0.2.5 is targeted by CVE-2026-25856 and CVE-2026-39908.
- GitLab module CVE-2026-97229 needs project write access and runs as the git user.
- NetScaler module text cites both CVE-2026-88771 and CVE-2026-88773.
Impact: Unauthenticated remote code execution and credential or account takeover
| Product | Affected | Fixed in |
|---|---|---|
| Flowise | 3.0.5 and earlier | — |
| SPIP | before 4.4.23 | 4.4.23 |
| OpenBullet2 | releases starting from version 0.2.5 | — |
| Citrix NetScaler | — | — |
| GitLab CE/EE | affected official GitLab CE/EE Linux amd64 releases | — |
- 1.Update SPIP to 4.4.23.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-58434 | Unauthenticated Account Takeover via Password Reset Token Leak in Flowise | 9.8 | 83% | PoC ×3 | |
CVE-2026-25856+1 related CVE | OpenBullet2 through version 0.3.2 contains an authenticated remote code execution vulnerability that allows authenticated users to execute arbitrary C# code on… | 8.7 group max | <1% | ||
| CVE-2026-88771 | Unauthenticated RCE in Citrix NetScaler ADC and Gateway | 9.5 | 82% | KEVPoC ×5 | KEV |
| CVE-2026-88773 | HTTP request smuggling in Citrix NetScaler ADC and Gateway | 9.3 | 3% | PoC ×2 | |
| CVE-2026-97229 | Unauthenticated RCE in GitLab CE/EE via CI/CD regex | 10.0 | 65% | KEVPoC ×6 | KEV |
From the original article
6 min read at rapid7.com
Buckle up Metasploit-Framework enthusiasts because we have another action packed release for you. I'm talking, unauthenticated remote code execution modules in some of the biggest names in network perimeter devices like Citrix NetScaler and Cisco Secure Email Gateway.
By Jack Heysel · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.