Metasploit Wrap-Up 05/01/2026
2026-05-02T19:23:46Z•5e1f6392242bdc5125b07e26c5d346796d96c563e0f3de45c0b2749772d87f86
CVE-2024-46987CVE-2026-31431CVE-2026-41940Camaleon CMSCopy FailLinux kernelMCP serverMDRMetasploitModel Context Protocolauthentication bypasscPaneldirectory traversalexploitlocal privilege escalationsecurity conferencethreat landscape
What happened
Rapid7 blog roundup (late Apr–May 2026): Metasploit added a read‑only MCP (Model Context Protocol) server to expose standardized search/recon tools to AI agents and shipped a local exploit for the high‑profile Linux LPE “Copy Fail” (CVE‑2026‑31431) that replaces ‘su’ in the page cache and targets AMD64/AARCH64. cPanel & WHM patched a critical authentication bypass (CVE‑2026‑41940, CVSS 9.8) allowing unauthenticated remote administrative access. Additional Metasploit module updates include a Camaleon CMS directory traversal (CVE‑2024‑46987) auxiliary module and other SMB/check‑method visibility
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 5e1f6392242bdc5125b07e26c5d346796d96c563e0f3de45c0b2749772d87f86
- Enrichment time
- 2026-05-02T19:23:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.