Metasploit Framework 6.5.9 Adds RCE Modules for Network Devices, GitLab and More
Summary
Metasploit Framework 6.5.9 adds exploit modules for unauthenticated RCE in Citrix NetScaler and Cisco Secure Email Gateway, GitLab CI/CD RCE, Flowise account takeover, OpenBullet2 flaws, and LoongArch64 payload support.
Key points
- The release adds a Flowise module for unauthenticated account takeover via a password-reset token returned by the API; the article says versions 3.0.5 and earlier are affected.
- A GitLab CI/CD regular-expression integer-overflow module can achieve remote command execution as the git user. It requires credentials with write access to a public project.
- New OpenBullet2 modules target an RCE flaw and NTLMv2 hash disclosure through a malicious UNC path; the article says both affect releases starting from version 0.2.5.
- The release includes a Citrix NetScaler command-injection RCE module. The article says the vendor had reported exploitation before public disclosure, but its CVE references in the entry conflict.
- A Cisco Secure Email Gateway module targets unauthenticated RCE as root; the article says the mapping to CVE-2026-76443 is based on the authors' assessment of vague advisories.
- Metasploit adds LoongArch64 Linux fetch payload support and Windows AArch64 DLL payload generation, alongside a Windows Docker persistence enhancement.
Article Details
- Event Type
- Metasploit Framework release adding exploit, auxiliary, scanner, and payload modules
- Impact
- The release adds modules for vulnerabilities that can enable unauthenticated remote code execution, account takeover, credential disclosure, and other security testing. The article says the Citrix NetScaler vulnerability was reported by the vendor as exploited in the wild before public disclosure. It does not report impact from this release being used in a real-world attack.
CVE
CVE-2024-5450bug_library_project · bug_libraryCVE reference: CVE-2024-5450CVE-2025-58434FlowiseAI · FlowiseCVE reference: CVE-2025-58434CVE-2026-25856openbullet · openbullet2CVE-2026-25856: A Remote Code Execution (RCE) exploit that abuses the plain C# execution mode to run arbitrary .NET APIs and access the file system.CVE-2026-39908openbullet · openbullet2CVE reference: CVE-2026-39908CVE-2026-76443Cisco · Cisco Secure Email; Cisco · Cisco Secure Email and Web ManagerCVE reference: CVE-2026-76443CVE-2026-88771Citrix NetScaler · ADC; Citrix NetScaler · GatewayCitrix NetScaler Unauthenticated Login Log Command Injection (CVE-2026-88771)CVE-2026-97229GitLab · GitLabCVE reference: CVE-2026-97229
People
jheysel-r7Credited as an author of the Metasploit exploit module for the GitLab CI/CD regular-expression integer-overflow vulnerability.sfewer-r7Credited as the author of a Metasploit exploit module for unauthenticated remote code execution in Cisco Secure Email Gateway and as a contributor to the Citrix NetScaler exploit module.
Vendors
CiscoI'm talking, unauthenticated remote code execution modules in some of the biggest names in network perimeter devices like Citrix NetScaler and Cisco Secure Email Gateway.CitrixI'm talking, unauthenticated remote code execution modules in some of the biggest names in network perimeter devices like Citrix NetScaler and Cisco Secure Email Gateway.GitLabThat's not all, we have an authenticated GitLab CI/CD regular expression integer overflow RCE module that was recently making head lines among many other awesome exploit modules.HashiCorpHashiCorp Consul Version Scanner
Products
Cisco Secure Email GatewayI'm talking, unauthenticated remote code execution modules in some of the biggest names in network perimeter devices like Citrix NetScaler and Cisco Secure Email Gateway.Citrix NetScalerI'm talking, unauthenticated remote code execution modules in some of the biggest names in network perimeter devices like Citrix NetScaler and Cisco Secure Email Gateway.ConsulHashiCorp Consul Version ScannerDockerPortainer Authenticated Docker API Remote RootFlowiseWe've got you covered this release with a Flowise authentication bypass and a OpenBullet2 NTLMv2 hash disclosure, because who doesn't love collecting and cracking (or in some cases relaying) NTLM hashes am I right or amGitLabThat's not all, we have an authenticated GitLab CI/CD regular expression integer overflow RCE module that was recently making head lines among many other awesome exploit modules.OpenBullet2We've got you covered this release with a Flowise authentication bypass and a OpenBullet2 NTLMv2 hash disclosure, because who doesn't love collecting and cracking (or in some cases relaying) NTLM hashes am I right or amPortainerPortainer Authenticated Docker API Remote RootSPIPSPIP Password Change IDOR Privilege EscalationWordPress Bug LibraryWordPress Bug Library Plugin Prior To 2.1.1 Unauthenticated PHP File Upload RCE