[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHkp8JyO4JISeM7eFxK3mXpr5D-TjXOZ4wv3jMwK_eFo":3},{"article":4,"iocs":47,"watch_terms":61,"solutions":62,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":34},"9c756f73-e30f-4510-8bef-47a223616ec0","Metasploit Wrapup: Unauth RCE modules in Network Perimeter Devices and much more","metasploit-wrapup-unauth-rce-modules-in-network-perimeter-devices-and-much-more-4a98b7",null,"Metasploit Framework has released new modules, including unauthenticated remote code execution (RCE) exploits for network perimeter devices like Citrix NetScaler and Cisco Secure Email Gateway. The update also features an authenticated RCE module for GitLab CI\u002FCD, an authentication bypass for Flowise, and an NTLMv2 hash disclosure for OpenBullet2. Additionally, support for LoongArch payloads has been expanded.","Metasploit adds new modules for unauthenticated RCE in NetScaler and Cisco Secure Email Gateway.","https:\u002F\u002Fwww.rapid7.com\u002Fblog\u002Fpost\u002Fpt-metasploit-wrapup-unauth-rce-modules-in-network-perimeter-devices-and-much-more","https:\u002F\u002Fimages.contentstack.io\u002Fv3\u002Fassets\u002Fblte4f029e766e6b253\u002Fblt0475760a2990dfd7\u002F6849ab41a770d7563190a3ea\u002Fmetasploit-fence.png","2026-11-06T13:52:11+00:00","2026-11-06T15:00:11.032747+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Metasploit Framework","product",{"name":21,"type":19},"Citrix NetScaler",{"name":23,"type":19},"Cisco Secure Email Gateway",{"name":25,"type":19},"GitLab CI\u002FCD",{"name":27,"type":19},"Flowise",{"name":29,"type":19},"OpenBullet2","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":8,"name":32,"slug":33},"Vulnerabilities","vulnerabilities",[35,40,42],{"category":36},{"id":37,"icon":8,"name":38,"slug":39},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":41},{"id":30,"icon":8,"name":32,"slug":33},{"category":43},{"id":44,"icon":8,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,52,55,58],{"type":49,"value":50,"context":51},"cve","CVE-2025-58434","Flowise Authentication Bypass",{"type":49,"value":53,"context":54},"CVE-2026-39908","OpenBullet2 NTLMv2 Hash Disclosure",{"type":49,"value":56,"context":57},"CVE-2026-25856","OpenBullet2 Remote Code Execution",{"type":49,"value":59,"context":60},"CVE-2026-88771","Citrix NetScaler Command Injection RCE",[18,21,23],{"controls":63,"vendors":147},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":94,"name":95,"problem":96,"products":97},"patch-management","Automated patch management","Known holes get closed in days, not months.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":46,"name":123,"problem":124,"products":125},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":143,"product_name":144,"url":145,"description":146},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[148],{"slug":149,"name":150,"logo_path":151,"roles":152},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png",[153],"reported_by",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":166},"unpatched-perimeter-devices-become-rce-targets-as-metasploit-modules-go-public","Unpatched Perimeter Devices Become RCE Targets as Metasploit Modules Go Public","The release of unauthenticated RCE modules for widely deployed network perimeter devices like Citrix NetScaler and Cisco Secure Email Gateway dramatically lowers the barrier for attackers to exploit known vulnerabilities. When exploits reach mature frameworks like Metasploit, even low-skilled threat actors can weaponize them at scale, making unpatched internet-facing devices extremely high-risk. The authentication bypass in Flowise and NTLMv2 hash disclosure in OpenBullet2 further illustrate that access control weaknesses compound the damage when patches are delayed. Organizations that treat perimeter device patching as a low-priority, scheduled task rather than an emergency response discipline are effectively leaving their front door unlocked once public exploits are available.",[159,160,161,162,163,164,165],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":167,"PCI DSS Requirement 6":168,"NIST SP 800-53 SI-2: Flaw Remediation":169,"OWASP A06:2021 Vulnerable and Outdated Components":170,"CIS Control 7: Continuous Vulnerability Management":171,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":172,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":173},"NIS2 mandates that essential and important entities implement appropriate technical measures for incident handling and vulnerability management, requiring rapid response to publicly disclosed exploits targeting network infrastructure.","PCI DSS Requirement 6 mandates the development and maintenance of secure systems, including timely application of security patches to protect internet-facing systems — directly applicable to the unpatched gateway devices exploited here.","SI-2 requires organizations to identify, report, and remediate flaws within defined time frames, which would have mandated emergency patching of perimeter devices once CVEs were published — well before public exploit modules appeared.","The affected products represent exactly the class of risk OWASP A06 targets — running known-vulnerable software versions on critical infrastructure that has public exploit code available.","Regular, automated scanning of internet-facing assets would have flagged the unpatched RCE vulnerabilities in Citrix NetScaler and Cisco Secure Email Gateway before Metasploit modules made them trivially exploitable.","This control explicitly requires timely identification and remediation of technical vulnerabilities in information systems, directly addressing the failure to patch internet-facing perimeter devices against known RCE flaws.","The authentication bypass in Flowise and NTLMv2 hash disclosure in OpenBullet2 highlight failures in access control that this CSF outcome addresses by requiring robust authentication mechanisms and credential protection."]