Metasploit Framework: Critical Updates and New Vulnerabilities

The Metasploit framework has recently received a significant update that introduces new features, improvements, and bug fixes. This update is particularly important for cybersecurity experts, as it introduces several critical vulnerabilities and new persistence techniques for Windows systems.

New Vulnerabilities and Exploit Modules

The update includes several new exploit modules that target common applications and systems. Here is a detailed analysis of the main additions:

1. A. Vulnerability in A. ChurchCRM

A critical vulnerability has been discovered in ChurchCRM version 6.2.0 and earlier. This vulnerability allows remote code execution (RCE) through a malicious file upload. The new exploit module, named ChurchCRM Database Restore RCE, exploits this flaw to gain control of the system.

2. B. Vulnerability in Selenium Grid and Selenoid

Another significant exploit module has been added for Selenium Grid and Selenoid. This module unifies two previous separate exploits for Chrome and Firefox into a single module that auto-detects available browsers and selects the most effective attack vector. The vulnerability allows remote code execution without requiring authentication.

3. C. Vulnerability in ChurchCRM

Another exploit module for ChurchCRM has been introduced, named ChurchCRM Database Restore RCE. This module exploits a file upload vulnerability to achieve remote code execution on ChurchCRM version 6.2.0 and earlier.

New Persistence Techniques for Windows

The update also introduces three new persistence techniques for Windows systems, allowing attackers to maintain access to compromised systems even after reboots.

1. A. Persistence via Bits Job

The module Windows Persistence Bits Job uses the Microsoft Bits service to maintain system access. This module is particularly effective because it exploits a legitimate Windows service, making detection more difficult.

2. B. Persistence via PowerShell Profile

The module Powershell Profile Persistence exploits PowerShell profiles to maintain access. This module is useful because PowerShell is an integrated component of Windows and is often not closely monitored.

3. C. Persistence via Windows Telemetry

The module Windows Telemetry Persistence abuses the Windows Telemetry scheduled task (Microsoft Compatibility Appraiser / CompatTelRunner) to establish persistence. This module writes a payload to disk and configures the telemetry task to execute it, resulting in a system-level Meterpreter session.

Improvements and Bug Fixes

In addition to the new exploit modules and persistence techniques, the update includes several improvements and bug fixes.

1. A. Improvements to Existing Modules

Numerous existing modules have been improved, such as the module for ChurchCRM, which now includes significant improvements.

2. B. Support for New Architectures

Support has been added for RISC-V architectures, enabling in-memory execution of ELF payloads on Linux RISC-V targets without writing to disk.

3. C. Critical Bug Fixes

Several critical bugs have been fixed, such as those related to the generation of ELF shared object payloads on ARM 32-bit and RISC-V 32-bit LE targets.

This update to the Metasploit framework represents a significant step in the field of cybersecurity. The new vulnerabilities and persistence techniques present challenges for system administrators and require greater attention to security. Security experts are advised to carefully evaluate these updates and implement the necessary protective measures.

For further details, you can consult the pull requests and commits on the Metasploit GitHub repository.

The Impact of Metasploit Updates on the Security Landscape

The latest update to the Metasploit framework not only introduces new offensive capabilities but also reflects significant evolutions in the cybersecurity landscape. These developments require an in-depth analysis of their implications for organizations and the security community at large.

New vulnerabilities and their critical impact

Among the new vulnerabilities exposed, the one in AVideo (CVE-2026-28501), an open-source video management system, stands out. The unauthenticated SQL injection represents a particularly high risk for organizations using this platform for managing multimedia content. The vulnerability allows the extraction of credentials, opening the door to the compromise of wider systems.

Similarly, the vulnerability in openDCIM (CVE-2026-28517) demonstrates how the chaining of multiple vulnerabilities can lead to remote code execution. This module exploits three distinct vulnerabilities, showing how attackers can leverage combinations of flaws to gain complete access to systems.

The importance of diversifying post-exploitation techniques

The addition of three new persistence techniques on Windows underscores the importance of a diversified defensive strategy. The use of legitimate services such as Microsoft BITS, PowerShell, and Telemetry scheduled tasks to maintain access to systems demonstrates how attackers can hide their activities by exploiting legitimate system operating functions.

These techniques require system administrators to adopt a multi-layered defensive approach. Anomalous observation of the behavior of these services becomes crucial to identifying suspicious activities that may indicate the presence of a persistent attacker within the network.

The evolution of system architectures

The addition of support for RISC-V architectures (riscv64le and riscv32le) in the framework represents a significant step towards preparing for future information infrastructures. With the increasing adoption of RISC-V architectures in various sectors, this extension allows security experts to assess potential vulnerabilities of these new systems before they become widely prevalent.

This capability of in-memory execution without disk writing (memfd_create) on RISC-V targets underscores the importance of developing adequate defensive capabilities for these new architectures, which could become primary targets for attackers as their diffusion increases.

Implications for organizations

Organizations must address these new threats with a proactive strategy. This includes:

  • Immediate updating of vulnerable systems
  • Implementation of additional security controls for critical services
  • Development of advanced detection capabilities for persistence techniques
  • Assessment of potential vulnerabilities in new hardware architectures

The Metasploit updates represent both a challenge and an opportunity for the cybersecurity sector. On the one hand, they expose new vulnerabilities and techniques that attackers could exploit. On the other hand, they provide security experts with the tools necessary to understand and defend against these emerging threats.

As technologies continue to evolve, it is essential that security approaches adapt accordingly. This requires continuous investment in research, capability development, and knowledge sharing within the security community.

Editorial Note and Disclaimer

The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.

GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not engage in real-time information activities.

The GoYou project does not provide professional, technical, legal, or financial advice and disclaims all responsibility for the misuse of the information published.

In the Crypto sector, every investment involves risks: readers are advised to always inform themselves independently before making any decisions.