Metasploit 6.5.4 Adds 16 Modules, Including Exploits for Five CISA KEV Vulnerabilities
Summary
Metasploit 6.5.4 adds 16 modules, including 10 exploit modules; five target vulnerabilities on CISA’s Known Exploited Vulnerabilities list. The update also includes scanner modules, fixes, and documentation updates.
Key points
- The update adds 16 modules, including 10 exploit modules and several auxiliary scanners.
- Five of the new exploit modules target vulnerabilities listed in CISA’s KEV catalog.
- New exploit modules cover products including Cisco Secure Firewall Management Center, SonicWall SMA1000, JetBrains TeamCity, Langflow, PaperCut, and Next.js.
- The SonicWall module targets an exploit chain reported as exploited in the wild; the article says version 12.5.0-02952 remediates it.
- New scanner modules can check for an Apache Tika XXE vulnerability exposed through Elasticsearch and identify Metasploit reverse handlers.
- The release also adds Windows persistence and Linux sandbox-evasion modules and fixes four reported bugs.
Article Details
- Event Type
- Metasploit Framework 6.5.4 release adding 16 modules, including 10 exploit modules, and fixing four bugs.
- Impact
- The new modules provide scanning and exploit capabilities for multiple vulnerabilities. The article reports that the SonicWall SMA1000 and PaperCut exploit chains were actively exploited in the wild; it does not report a specific impact on victims.
CVE
CVE-2025-54988Description: Adds an auxiliary scanner module for CVE-2025-54988/CVE-2025-66516. The module validates an XML External Entity (XXE) vulnerability in Apache Tika's XFA parser exposed through the Elasticsearch attachmentCVE-2025-66516CVE reference: CVE-2025-66516CVE-2026-19295CVE reference: CVE-2026-19295CVE-2026-20079CVE reference: CVE-2026-20079CVE-2026-20929CVE reference: CVE-2026-20929CVE-2026-23744CVE reference: CVE-2026-23744CVE-2026-48558CVE reference: CVE-2026-48558CVE-2026-63077CVE reference: CVE-2026-63077CVE-2026-75604CVE reference: CVE-2026-75604CVE-2026-81578PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)CVE-2026-82078PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)CVE-2026-83548exploit chain that was disclosed in the first week of September as being exploited in-the-wild. CVE-2026-83548 is an SSRF used to bypass auth. SMA1000-9427 is an RCE with low privileges via CouchDB read/writeCVE-2026-83549CVE reference: CVE-2026-83549
People
Adam BabisListed as an author of the SonicWall SMA1000 exploit module.Antoni TremblayListed as an author of the JetBrains TeamCity exploit module.Arian EidizadehListed as an author of the Cisco Secure Firewall Management Center exploit module.Benoit HuaListed as an author of the SPIP blind SQL injection scanner module.Brandon SakaiListed as an author of the Cisco Secure Firewall Management Center exploit module.Cale BlackListed as an author of the Cisco Secure Firewall Management Center exploit module.earthenvesselListed as an author of the MCPJam Inspector exploit module.Emanuele CervelliListed as the author of the Boot Verification Program and Windows Time Provider persistence modules.Franck ChevalierListed as an author of the SPIP blind SQL injection scanner module.h00dieListed as the author of the Metasploit Payload Handler Detection scanner module.Jean-Marie BourbonListed as an author of the Elasticsearch ingest-attachment scanner module.Julien VoisinListed as an author of the SPIP scanner and autosave RCE modules.Louay-075Listed as an author of the MCPJam Inspector exploit module.Massimo BertocchiListed as the author of the Linux x64 sandbox environment gate module.Pushpender RathoreListed as the author of the ESC8 Kerberos relay module.Richard HoweListed as the author of the Langflow exploit module.William PerryListed as an author of the SonicWall SMA1000 exploit module.
Products
Apache TikaElasticsearch ingest-attachment Apache Tika XFA XXE Local File ReadCisco Secure Firewall Management CenterCisco Secure Firewall Management Center Authentication Bypass RCEElasticsearchElasticsearch ingest-attachment Apache Tika XFA XXE Local File ReadJetBrains TeamCityJetBrains TeamCity Agent Polling Unauthenticated Remote Code ExecutionLangflowten exploit modules, with five on the CISA KEV list. Cisco, Papercut, Sonicwall, Jetbrains, and Langflow all have exploit modules, and not to be outdone, we even have a Metasploit scanner to watch the watchers!MCPJam InspectorMCPJam Inspector Connect API Command ExecutionMetasploit FrameworkAs always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:Next.jsNext.js Unauthenticated RCE on Windows ServersPaperCut MFDescription: Adds an exploit module for the recent PaperCut MF and PaperCut NG exploit chain (CVE-2026-81578 + CVE-2026-82078) that was reported last week as a zero-day being actively exploited in the wild.PaperCut NGPaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078)SimpleHelpSimpleHelp OIDC Authentication Bypass Remote Code ExecutionSonicWall SMA1000SonicWall SMA1000 WorkPlace SSRF to Root Remote Code ExecutionSPIPSPIP Unauthenticated Blind SQLi via Date Field Escaping Bypass