Metasploit Wrap-Up 04/03/2026
2026-04-05T19:23:50Z•963745b1d335957e197407e4fba76ed40b6d01c6ecce268fd60d552660c1c78a
CVE-2026-23767bpfdoreclipse-cheescposfreescoutgrav-cmshkcuhttp-command-execicmpinitial-access-brokerskernel-backdoormetasploitntlm-relayprintersremote-code-executionsmb-relaystateless-c2telecom-infrastructureunauthenticated-rceuserinitmprlogonscriptwindows-persistence
What happened
Rapid7 published multiple security updates and research items. Metasploit Framework additions include new HTTP/HTTPS CMD payloads for x64/x86 Windows, new exploit modules for FreeScout (unauthenticated RCE via ZWSP .htaccess bypass) and Grav CMS RCE, a generic multi/http/os_cmd_exec module for HTTP-based command execution, and a new Windows persistence technique abusing HKCU\Environment\UserInitMprLogonScript. Other notable items: an ESC/POS network printer command-injection vulnerability (CVE-2026-23767) is tracked and a Metasploit auxiliary was added; an unauthenticated Eclipse Che machine‑/
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 963745b1d335957e197407e4fba76ed40b6d01c6ecce268fd60d552660c1c78a
- Enrichment time
- 2026-04-05T19:23:50Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.