Weekly Metasploit Update: Exploits for FlowiseAI CSV Agent and MacOS Package Kit
2026-07-14T07:23:42Z•311e4d22823c070474b563d81a70b3ed5f0d5746b74e50727e1160fe4a707b9e
AI riskAnthropicApache .htaccessCVE-2026-41264FlowiseFlowise CSV AgentPeyara Remote MouseProject GlasswingPsExecRCESMB to Meterpreterexploitmetasploitmulti-agent AIpersistencered teamingremote code executionvulnerability disclosurevulnerability standards
What happened
Rapid7 published multiple posts covering Metasploit module updates and broader AI-driven security trends. New Metasploit content includes an unauthenticated remote code execution (RCE) exploit for Flowise CSV Agent (Flowise CSV Agent Prompt Injection RCE, CVE-2026-41264) which allows attackers to upload a CSV containing arbitrary Python to achieve code execution, an unauthenticated RCE for Peyara Remote Mouse v1.0.1, an Apache .htaccess persistence module (mod_cgi .htaccess web shell), and a module to upgrade SMB sessions to Meterpreter via PsExec. Separately, Rapid7 discusses defensive/oper‑/
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 311e4d22823c070474b563d81a70b3ed5f0d5746b74e50727e1160fe4a707b9e
- Enrichment time
- 2026-07-14T07:23:42Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.