Metasploit Update Adds Exploit Modules, Windows AArch64 Payloads and Enhancements
Summary
The Metasploit Framework 6.5.6 roundup adds modules for multiple vulnerabilities and remote code execution flaws, Windows AArch64 fetch payloads, Linux privilege escalation, and other features and fixes.
Key points
- New modules include scanners for vLLM CVE-2026-22778 and SMB share password enumeration targeting CVE-2000-0979.
- Exploit modules cover unauthenticated remote code execution in N-able N-central, dizqueTV, Langflow, LiteLLM Proxy, and OpenCTI.
- The release adds Linux local privilege-escalation modules for snapd and DirtyClone, plus an Ollama Windows auto-update persistence module.
- New Windows AArch64 payload adapters support FTP, HTTP, HTTPS, and TFTP fetch methods.
- Enhancements include AV/EDR detection in a Linux protections-gathering module and a Rake-based module generator.
- The update also improves fileless fetch payload reliability and fixes issues in scanners and other modules.
Article Details
- Event Type
- Metasploit Framework release adding exploit, scanner, payload, and post modules, alongside enhancements and bug fixes.
- Impact
- The release adds modules for detecting or exploiting vulnerabilities and performing other security-testing tasks, including remote code execution, local privilege escalation, information-leak scanning, persistence, and Windows AArch64 payload delivery. The article reports no real-world victim impact.
CVE
CVE-2000-0979CVE-2000-0979 SMB Share Password EnumeratorCVE-2024-58286CVE reference: CVE-2024-58286CVE-2026-0770CVE reference: CVE-2026-0770CVE-2026-22778CVE reference: CVE-2026-22778CVE-2026-3888CVE reference: CVE-2026-3888CVE-2026-42249CVE reference: CVE-2026-42249CVE-2026-42271CVE reference: CVE-2026-42271CVE-2026-43503CVE reference: CVE-2026-43503CVE-2026-86218CVE reference: CVE-2026-86218
People
Ahmed Said Saud Al-BusaidiNamed author of the dizqueTV remote-code-execution module.Alexander "xaitax" HagenahNamed author of the Windows AArch64 fetch adapters.Bartłomiej DmitrukNamed author of the Ollama Windows auto-update persistence module.Brendan WattersNamed author of the Windows AArch64 fetch adapters.Eddy TsalolikhinNamed author of the DirtyClone local privilege-escalation module.Ege BalciNamed author of the OpenCTI SafeJS sandbox-escape exploit.Kenneth LaCroixNamed author of the vLLM information-leak scanner module.Muhammad Sulthon NurbahariNamed author of the dizqueTV remote-code-execution module.Or PelesNamed author of the DirtyClone local privilege-escalation module.Zoltan BalazsNamed author of the CVE-2000-0979 SMB share password enumerator.
Products
dizqueTVdizqueTV Unauthenticated Remote Code ExecutionLangflowLangflow Unauthenticated RCE (validate endpoint)LiteLLMBerriAI LiteLLM Proxy MCP Test Endpoint Command ExecutionN-able N-centralN-able N-central Struts BeanUtils Unauthenticated RCEOllamaOllama Windows Auto-Update Path Traversal PersistenceOpenCTIOpenCTI JSON Mapper safeEjs Sandbox Escape RCEsnapdLocal Privilege Escalation in snapdvLLMvLLM Multimodal Heap-Address Information Leak Scanner