Weekly Metasploit Update: New Kerberos/Certificate tracing options, and multiple new modules
2026-06-14T07:23:43Z•0970914ac70d5ac7fbf4a2d5b6f3d412e926c2749cefa255a26b036752b405b8
CVE-2026-10520CVE-2026-10523CVE-2026-35273LLMai-as-a-serviceanthropicautomated-threat-huntingbrowser-vulnerabilitiescertificatecriminal-aiivantikerberosmetasploitmicrosoftnightmare-eclipseoraclepatch-tuesdaypeoplesoftproject-glasswingrapid7sentryunderground-market
What happened
This Rapid7 roundup covers multiple security developments: Metasploit added new debugging options (KerberosTicketTrace and CertificateTrace) to aid module troubleshooting; Oracle PeopleSoft received an out-of-band patch for an actively exploited, critical unauthenticated RCE zero-day (CVE-2026-35273, CVSS 9.8) classified as SSRF-related; Ivanti Sentry has two critical, remotely exploitable vulnerabilities (CVE-2026-10520 — OS command injection/RCE, CVSS 10.0; CVE-2026-10523 — authentication bypass, CVSS 9.9) with vendor advisories and patches; Microsoft’s June 2026 Patch Tuesday addresses ~200
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 0970914ac70d5ac7fbf4a2d5b6f3d412e926c2749cefa255a26b036752b405b8
- Enrichment time
- 2026-06-14T07:23:43Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.