Metasploit Wrap Up: This One Goes to Sixteen!

Monitoren (31/100) — monitoren. Bepalend: gemeentelijke relevantie (48/100) en technische ernst (42/100). Houd dit in de gaten; directe actie is nu niet nodig. Deze prioritering is regelgebaseerd en navolgbaar; weeg de aannames en onzekerheden mee voor de eigen gemeentelijke omgeving.

Deze prioritering is regelgebaseerd en navolgbaar. Een CISO kan deze onderbouwing gebruiken richting directie of ICT-management; stem de opvolging af op de eigen gemeentelijke omgeving.

De acties zijn regelgebaseerd gegenereerd. Stem ze af op de eigen gemeentelijke omgeving en wijs per actie een eigenaar en deadline toe.

// Defender-waarschuwingen rond endpointcompromittatie
SecurityAlert
| where TimeGenerated > ago(7d)
| where ProductName == "Microsoft Defender for Endpoint"
| where AlertSeverity in ("High", "Medium")
| project TimeGenerated, AlertName, AlertSeverity, CompromisedEntity,
    Description
| order by TimeGenerated desc

// Aanmeldingen vanuit onverwachte landen
let bekendeLanden = dynamic(["NL", "BE", "DE"]);
SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == 0
| where isnotempty(Location) and Location !in (bekendeLanden)
| summarize Aanmeldingen = count() by UserPrincipalName, Location
| order by Aanmeldingen desc

// Impossible travel-risicodetecties (Entra ID Protection)
AADUserRiskEvents
| where TimeGenerated > ago(7d)
| where RiskEventType in ("impossibleTravel", "unfamiliarFeatures",
    "anonymizedIPAddress")
| project TimeGenerated, UserPrincipalName, RiskEventType, RiskLevel,
    IpAddress, Location
| order by TimeGenerated desc

Deze informatie is uitsluitend defensief: detectie en hunting. De KQL-queries zijn read-only en bedoeld voor Microsoft Sentinel.

Geachte heer/mevrouw,

Naar aanleiding van een beveiligingsmelding met kenmerk CVE-2025-54988 doet onze gemeente een uitvraag bij u als leverancier. Deze uitvraag dient ter verificatie en feitenvaststelling: wij willen vaststellen of en in welke mate de aan onze gemeente geleverde dienstverlening wordt geraakt. Het betreft mogelijk het product of onderdeel "Opensource".

Wij verzoeken u de onderstaande vragen volledig en onderbouwd te beantwoorden en uw reactie binnen tien (10) werkdagen na ontvangst van dit bericht schriftelijk aan te leveren bij de informatiebeveiligingsfunctie van onze gemeente. Zijn bepaalde gegevens nog niet beschikbaar, dan ontvangen wij graag een tussentijdse terugkoppeling.

Vragen:
1. Gebruikt u de kwetsbare component of het geraakte product?
2. Welke versies zijn bij u in gebruik?
3. Is de kwetsbaarheid van toepassing op de dienstverlening aan onze gemeente?
4. Is de kwetsbaarheid inmiddels gepatcht?
5. Zo ja, op welke datum is de patch doorgevoerd?
6. Zo nee, welke mitigerende maatregelen zijn genomen?
7. Is er actief misbruik van de kwetsbaarheid geconstateerd?
8. Is er logging of forensisch onderzoek uitgevoerd?
9. Is er sprake van een risico op een datalek?
10. Wanneer verwacht u een definitieve oplossing door te voeren?
11. Welke restrisico's blijven na de oplossing bestaan?
12. Welke communicatie mogen wij richting onze interne stakeholders gebruiken?

Deze uitvraag is bedoeld om de feiten vast te stellen en gezamenlijk tot een passende opvolging te komen. Wij stellen uw tijdige medewerking op prijs.

Met vriendelijke groet,

[Naam]
Namens de informatiebeveiligingsfunctie
Gemeente [Gemeente]

Vul vóór verzending de afzender en gemeentenaam in. De tekst is zakelijk en gericht op feitenvaststelling; pas hem aan op de eigen situatie.

Deze dreiging raakt de onderstaande governance-thema's. Met de aanbevolen bewijsstukken kunt u aantonen dat het signaal is opgevolgd — bruikbaar voor BIO2, NIS2/CBW, ISMS en de ENSIA-verantwoording.

This One Goes to Sixteen! Another banger from Metasploit with sixteen new modules, including ten exploit modules, with five on the CISA KEV list. Cisco, Papercut, Sonicwall, Jetbrains, and Langflow all have exploit modules, and not to be outdone, we even have a Metasploit scanner to watch the watchers! New module content (16) Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read Authors: Bourbon Offensive Security Services and Jean-Marie Bourbon Type: Auxiliary Pull request: #21739 contributed by kmkz Path: scanner/http/elasticsearch_tika_xfa_xxe CVE reference: CVE-2025-66516 Description: Adds an auxiliary scanner module for CVE-2025-54988/CVE-2025-66516. The module validates an XML External Entity (XXE) vulnerability in Apache Tika's XFA parser exposed through the Elasticsearch attachment ingest processor. SPIP Unauthenticated Blind SQLi via Date Field Escaping Bypass Authors: Benoit Hua, Franck Chevalier, Julien Voisin, and ka3n1x Type: Auxiliary Pull request: #21791 contributed by jvoisin Path: scanner/http/spip_annee_sqli Description: Adds modules/auxiliary/scanner/http/spip_annee_sqli.rb which exploits a blind SQL injection in SPIP's date column escaping logic. Metasploit Payload Handler Detection (TCP/UDP/HTTP/HTTPS) Author: h00die Type: Auxiliary Pull request: #21551 contributed by h00die Path: scanner/msf/handler_detect Description: Adds a scanner module to enumerate ports on a host and determine if they're a Metasploit Reverse Handler or not, and if they are, what kind of shell they were going to land. ESC8 Relay: SMB to HTTP(S) via Kerberos Author: Pushpender Rathore Type: Auxiliary Pull request: #21709 contributed by Pushpenderrathore Path: server/relay/esc8_kerberos CVE reference: CVE-2026-20929 Description: This introduces native Kerberos authentication relay capabilities to the framework's relay stack. It includes a new auxiliary module (esc8_kerberos) that exploits CVE-2026-20929 by targeting AD CS Web Enrollment (ESC8). The module captures an SMB2 AP-REQ from a coerced client and seamlessly replays the authentication to the target certificate server over HTTP. This chain ultimately allows an attacker to issue a certificate for the coerced victim and obtain a valid Kerberos TGT without requiring their credentials. Linux x64 Sandbox Environment Gate Author: Massimo Bertocchi Type: Evasion Pull request: #21642 contributed by litemars Path: linux/x64/sandbox_gate Description: Adds a Linux x64 sandbox‑evasion module that performs lightweight runtime environment checks and aborts execution when a likely sandbox or VM is detected. Cisco Secure Firewall Management Center Authentication Bypass RCE Authors: Arian Eidizadeh, Brandon Sakai, and Cale Black Type: Exploit Pull request: #21796 contributed by CyberAuth Path: linux/http/cisco_fmc_auth_bypass_rce CVE reference: CVE-2026-20079 Description: Adds a native Metasploit exploit module for CVE-2026-20079, an unauthenticated authentication bypass in Cisco Secure Firewall Management Center (FMC). SonicWall SMA1000 WorkPlace SSRF to Root Remote Code Execution Authors: Adam Babis, William Perry, and sfewer-r7 Type: Exploit Pull request: #21883 contributed by sfewer-r7 Path: linux/http/sonicwall_sma1000_couchdb_rce CVE reference: CVE-2026-83549 Description: This adds an exploit module for the recent SonicWall SMA1000 zero-day exploit chain that was disclosed in the first week of September as being exploited in-the-wild. CVE-2026-83548 is an SSRF used to bypass auth. SMA1000-9427 is an RCE with low privileges via CouchDB read/write primitives. CVE-2026-83549 is a command injection in cmsSnmpTrap.sh for RCE with root privs. The patched version 12.5.0-02952 has been verified to successfully remediate this exploit chain. JetBrains TeamCity Agent Polling Unauthenticated Remote Code Execution Authors: Antoni Tremblay and sfewer-r7 Type: Exploit Pull request: #21775 contributed by sfewer-r7 Path: multi/http/jetbrains_teamcity_rce_cve_2026_63077 CVE reference: CVE-2026-63077 Description: This introduces a new unauthenticated Remote Code Execution (RCE) exploit module for JetBrains TeamCity, targeting the vulnerability tracked as CVE-2026-63077. The module exploits an unsafe XStream deserialization flaw within the agent polling protocol to deliver and execute a one-shot JSP payload on the server. The module supports both Windows and Linux targets and features built-in cleanup logic to automatically unregister and remove the fake build agent created during the exploitation process. Langflow AI authenticated RCE Author: Richard Howe Type: Exploit Pull request: #21837 contributed by rmhowe425 Path: multi/http/langflow_auth_rce_cve_2026_19295 CVE reference: CVE-2026-19295 Description: Adds a new module targeting CVE-2026-19295, an authenticated remote code execution vulnerability impacting Langflow versions 1.10.0 and below. MCPJam Inspector Connect API Command Execution Authors: Louay-075 and earthenvessel Type: Exploit Pull request: #21655 contributed by earthenvessel Path: multi/http/mcpjam_inspector_rce CVE reference: CVE-2026-23744 Description: This adds a new exploit module for CVE-2026-23744, an unauthenticated command execution vulnerability in MCPJam Inspector. The module targets the /api/mcp/connect endpoint. Vulnerable versions accept a JSON serverConfig object containing a command and args array, then use those values to start an MCP server. When MCPJam Inspector is exposed on a routable interface, an unauthenticated remote attacker can abuse this behavior to execute operating system commands as the user running MCPJam Inspector. PaperCut NG/MF Unauthenticated RCE (CVE-2026-81578 + CVE-2026-82078) Author: sfewer-r7 Type: Exploit Pull request: #21842 contributed by sfewer-r7 Path: multi/http/papercut_ng_external_user_lookup_rce CVE reference: CVE-2026-82078 Description: Adds an exploit module for the recent PaperCut MF and PaperCut NG exploit chain (CVE-2026-81578 + CVE-2026-82078) that was reported last week as a zero-day being actively exploited in the wild. SimpleHelp OIDC Authentication Bypass Remote Code Execution Authors: Blackpoint Cyber, Horizon3.ai, Zach Hanley, and jheysel-r7 Type: Exploit Pull request: #21825 contributed by jheysel-r7 Path: multi/http/simplehelp_oidc_auth_bypass_rce CVE reference: CVE-2026-48558 Description: Adds an exploit module for CVE-2026-48558, an OIDC authentication bypass affecting SimpleHelp 5.5.0 through 5.5.15. SPIP Autosave Session Unauthenticated RCE Author: Julien Voisin Type: Exploit Pull request: #21859 contributed by jvoisin Path: multi/http/spip_autosave_rce Description: Adds a module targeting an unauthenticated remote code execution vulnerability in SPIP <= 4.4.21 via the forum autosave session handler. The action=session endpoint lets any visitor store arbitrary PHP code in a session variable, which is then executed by the template engine when the article page is rendered. No CVE has yet been issued. Next.js Unauthenticated RCE on Windows Servers Authors: Avishek Sarkar, Bogyeom Lee, and Maksim Rogov Type: Exploit Pull request: #21834 contributed by vognik Path: windows/http/nextjs_unauth_rce_cve_2026_75604 CVE reference: CVE-2026-75604 Description: Adds a module targeting CVE-2026-75604, a Remote Code Execution (RCE) vulnerability in Next.js applications hosted on Windows servers. Specifically crafted requests can execute arbitrary code on the target server running Next.js versions from 13.4.0 up to 15.5.24, and 16.0.0 up to 16.3.3. Boot Verification Program Persistence Author: Emanuele Cervelli Type: Exploit Pull request: #21550 contributed by M4nu02 Path: windows/persistence/boot_verification_program Description: Adds a Windows persistence module leveraging the registry key BootVerificationProgram. Windows Time Provider Persistence Author: Emanuele Cervelli Type: Exploit Pull request: #21522 contributed by M4nu02 Path: windows/persistence/time_provider Description: Adds a new persistence module that registers a custom Time Provider DLL under the W32Time service registry key. Bugs fixed (4) #21719 from Pushpenderrathore - Fixes a race condition in the module Metadata cache. #21838 from jheysel-r7 - Fixes payload choosing behaviour when swapping targets to auto-select the most fitting payload which can now also include Java payloads. #21853 from Pushpenderrathore - Three fixes to the core Rex::Proto::DNS forward/cache path that surface once the DNS server is used as a selective poisoner in front of a real upstream resolver #21861 from prithvee07 - Fixes a recent regression in the vsftpd_234_backdoor module where by updating the module to support ARCH_CMD payloads we inadvertently dropped support for cmd/unix/interact payloads. Both payloads are now supported. Documentation You can find the latest Metasploit documentation on our docsite at docs.metasploit.com . Get it As always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub: Pull Requests 6.5.3…6.5.4 Full diff 6.5.3…6.5.4 If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest. To install fresh without using git, you can use the open-source-only Nightly Installers or the commercial edition Metasploit Pro.