Metasploit | Penetration Testing Software, Pen Testing Security

Knowledge is power, especially when it’s shared. A collaboration between the open source community and Rapid7, Metasploit helps security teams do more than just verify vulnerabilities, manage security assessments, and improve security awareness; it empowers and arms defenders to always stay one step (or two) ahead of the game.

Title	Date	Author
Land #20835, adds module unauthenticated command injection Eclipse Che machine-exec (CVE-2025-12548) Add Eclipse Che machine-exec unauthenticated RCE (CVE-2025-12548)	Mar 25, 2026	msutovsky-r7
Land #20719, adds module for authenticated command injection in FreePBX filestore (CVE-2025-64328) Add authenticated RCE module for FreePBX filestore (CVE-2025-64328)	Mar 13, 2026	msutovsky-r7
Land #20730, Allow toggling the SACL in LDAP queries # Release Notes This update modifies the ldap_query module to skip querying the SACL (System Access Control List) on security descriptors by default. This behavior is now controlled by a new option, LDAP::QuerySacl. This change is necessary when using a non-privileged user to query security descriptors via LDAP; otherwise, querying the SACL will cause the entire query to be blocked, resulting in no security descriptors being returned.	Mar 11, 2026	cdelafuente-r7
Revert "Land #20852, exposes encoder options for exploit and payloads" This reverts commit 96958dedbbccb88d545356fed5950911f6160a4f, reversing changes made to 8e03b6e98a094c8d1d54fba9489069f93ecd0cd9.	Mar 10, 2026	adfoster-r7
Revert "Land #21088, Fix base64 encoder" This reverts commit 437f7387547cb6f310b09a62b59de5b3360dd718, reversing changes made to e6ee6a7c94610e045fac6cddd5f5c391ea128c07.	Mar 10, 2026	adfoster-r7
Land #21001, adds module for SPIP Saisies plugin (CVE-2025-71243) Add SPIP Saisies plugin RCE module (CVE-2025-71243)	Mar 09, 2026	msutovsky-r7

Title

Date

Author

Land #20835, adds module unauthenticated command injection Eclipse Che machine-exec (CVE-2025-12548) Add Eclipse Che machine-exec unauthenticated RCE (CVE-2025-12548)

Mar 25, 2026

msutovsky-r7

Land #20719, adds module for authenticated command injection in FreePBX filestore (CVE-2025-64328) Add authenticated RCE module for FreePBX filestore (CVE-2025-64328)

Mar 13, 2026

msutovsky-r7

Land #20730, Allow toggling the SACL in LDAP queries # Release Notes This update modifies the ldap_query module to skip querying the SACL (System Access Control List) on security descriptors by default. This behavior is now controlled by a new option, LDAP::QuerySacl. This change is necessary when using a non-privileged user to query security descriptors via LDAP; otherwise, querying the SACL will cause the entire query to be blocked, resulting in no security descriptors being returned.

Mar 11, 2026

cdelafuente-r7

Revert "Land #20852, exposes encoder options for exploit and payloads" This reverts commit 96958dedbbccb88d545356fed5950911f6160a4f, reversing changes made to 8e03b6e98a094c8d1d54fba9489069f93ecd0cd9.

Mar 10, 2026

adfoster-r7

Revert "Land #21088, Fix base64 encoder" This reverts commit 437f7387547cb6f310b09a62b59de5b3360dd718, reversing changes made to e6ee6a7c94610e045fac6cddd5f5c391ea128c07.

Mar 10, 2026

adfoster-r7

Land #21001, adds module for SPIP Saisies plugin (CVE-2025-71243) Add SPIP Saisies plugin RCE module (CVE-2025-71243)

Mar 09, 2026

msutovsky-r7

Latest Pull Requests

Name	Labels	Author
Additional agents md file edits	rn-no-release-notes	adfoster-r7
metasploit-framework		resank6661
Fix encoding issues in files	rn-no-release-notes	adfoster-r7
Add MITRE ATT&CK tags for two modules	easy , rn-no-release-notes , additional-testing-required	zeroSteiner
Bump the setup-php version to 2.37.0	rn-no-release-notes	zeroSteiner
Add additional markdown notes	rn-no-release-notes	adfoster-r7

Name

Labels

Author

Additional agents md file edits

rn-no-release-notes

adfoster-r7

metasploit-framework

resank6661

Fix encoding issues in files

rn-no-release-notes

adfoster-r7

Add MITRE ATT&CK tags for two modules

easy , rn-no-release-notes , additional-testing-required

zeroSteiner

Bump the setup-php version to 2.37.0

rn-no-release-notes

zeroSteiner

Add additional markdown notes

rn-no-release-notes

adfoster-r7

Create a Pull Request

Recent Blog Posts

Fri Mar 27 2026

Metasploit Wrap-Up 03/27/2026

Better NTLM Relaying FunctionalityThis week’s release brings an improvement to the SMB NTLM relay server. In the past, it’s support has been expanded with modules for relaying to HTTP (ESC8), MSSQL and LDAP while still receiv...

Fri Mar 20 2026

Metasploit Wrap-Up 03/20/2026

♫ I Just Called ♫ To Say ♫ 7f45 4c46 0201 0100 0000 0000 0000 0000 0300 3e00 0100♫This release contains 2 new exploit modules, 2 enhancements, and 7 bug fixes. Community contributor Chocapikk submitted both exploit modules th...

Fri Mar 13 2026

Metasploit Wrap-Up 03/13/2026

No bad luck here: Friday the 13th brings new modules and a Metasploit Pro milestoneThis week’s Metasploit Framework release delivers three new modules across reconnaissance, evasion, and exploitation: LeakIX-powered discovery...

View More Metasploit Blog Posts