Metasploit Adds New Modules Targeting Linux RC4, BeyondTrust, and Registry Persistence
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
The latest Metasploit update, released on February 27, 2026, brings significant firepower to security professionals and penetration testers<\/a>. <\/p>\n The release introduces seven new modules, nine feature enhancements, and critical bug fixes. <\/p>\n Standout additions include unauthenticated remote code execution (RCE) exploits for Ollama, BeyondTrust, and Grandstream VoIP devices, alongside advanced evasion techniques for Linux environments.<\/p>\n This update delivers powerful exploit chains targeting high-severity vulnerabilities<\/a> across enterprise and artificial intelligence infrastructure.<\/p>\n Ollama Model Registry Path Traversal (CVE-2024-37032):<\/strong>\u00a0Carrying a CVSS score of 8.8, this flaw allows an attacker to exploit Ollama\u2019s pull mechanism using path traversal sequences. <\/p>\n The module loads a rogue OCI registry to write malicious shared object files into the target. By forcing Ollama to spawn a new process, the malicious library is loaded, resulting in unauthenticated root RCE.<\/a>\u200b<\/p>\n BeyondTrust PRA and RS Command Injection (CVE-2026-1731):<\/strong>\u00a0This critical vulnerability carries a CVSS score of 9.9 and allows unauthenticated command injection in BeyondTrust Privileged Remote Access <\/a>and Remote Support appliances. <\/p>\n The update also introduces a new BeyondTrust helper library to streamline future module development.<\/a>\u200b<\/p>\n Grandstream GXP1600 Stack Overflow (CVE-2026-2329):<\/strong>\u00a0Targeting VoIP devices, this critical flaw has a CVSS score of 9.3 and grants attackers a root session. <\/p>\n Rapid7 release includes<\/a> one exploit module and two post-exploitation modules that leverage this access to steal credentials and proxy SIP traffic for packet capture.<\/a>\u200b<\/p>\nCritical Remote Code Execution Exploits<\/strong><\/h2>\n