Metasploit Wrap-Up 04/17/2026
2026-04-19T19:23:43Z•fd84e04ae14534b68ecc93a7ecf2985afc13c873b3b970cb9d3ed89f674c2924
AVideoclickfixcloud-detectionexploit-modulesmetasploitmicrosoftnginx-uiopenDCIMpatch-tuesdayphishingpost-exploitationrceremediationsoc-detectionsql-injection
What happened
Rapid7 published multiple security updates and analyses in mid-April 2026: Metasploit Framework landed seven new modules (including RCE/SQLi modules targeting AVideo and openDCIM — CVE-2026-28501 and CVE-2026-28517 — plus modules for Selenium Grid/Selenoid and ChurchCRM, and new Windows post-exploitation persistence techniques). Rapid7 also detailed a critical missing-authentication vulnerability in Nginx UI (CVE-2026-33032, CVSS 9.8). Their SOC observed a ClickFix phishing campaign masquerading as a Claude installer, and Rapid7’s Patch Tuesday summary noted Microsoft published 167 fixes inApr
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- fd84e04ae14534b68ecc93a7ecf2985afc13c873b3b970cb9d3ed89f674c2924
- Enrichment time
- 2026-04-19T19:23:43Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.