Metasploit Wrap-Up 03/06/2026
2026-03-07T19:23:51Z•bd704504215ad54af484b0497946aba5ad7f196c68803ff509ded6d18dc484cc
ai-code-securityarm64auxiliary-scannersbeyondtrustcommand-injectiondastdigital-footprintsencodersevasionexploit-modulesgrandstreamin-memory-executionjinja2-sstimajordomometasploitollamapath-traversalrc4remote-code-executionsecurity-summitstack-overflowtactical-rmmunauthenticated-rce
What happened
Rapid7 blog roundup highlighting Metasploit framework updates that add runtime encoder selection and multiple new modules—including unauthenticated and remote code execution exploits (Tactical RMM Jinja2 SSTI, an unauthenticated MajorDoMo exploit) and explicit support for recent high-impact vulnerabilities. Notable CVEs called out: CVE-2024-37032 (Ollama path traversal → chained unauthenticated root RCE), CVE-2026-2329 (Grandstream GXP1600 stack overflow), and CVE-2026-1731 (BeyondTrust PRA/RS command injection). The releases also introduce evasion tooling (Linux RC4 packer, ARM64 RC4, in‑mem‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- bd704504215ad54af484b0497946aba5ad7f196c68803ff509ded6d18dc484cc
- Enrichment time
- 2026-03-07T19:23:51Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.