Metasploit Pro Version 5.1.0-2026101901 Release Notes

Software release date: October 19, 2026 | Release notes published: October 19, 2026

New Module Content (20)

#21072 - Adds an auxiliary module that exploits CVE-2000-0979, an information disclosure vulnerability in Microsoft Windows 9x/Me SMB share-level password authentication. The server validates passwords one character at a time, allowing byte-by-byte enumeration that significantly reduces brute-force complexity.
#21423 - Adds a Windows persistence module that leverages the Ollama auto-update mechanism.
#21516 - Adds a post module that uploads a PAM shared object file into the authentication chain on Linux targets, compiling it on the system when the target is not x64.
#21532 - Adds a module targeting CVE-2026-3888, a TOCTOU race condition in snap-confine, the SUID binary used by the snapd package manager to enforce snap sandbox boundaries.
#21585 - Adds an exploit module for CVE-2026-42271, a command execution flaw in the BerriAI LiteLLM proxy’s MCP test REST endpoints.
#21592 - Adds an auxiliary scanner module, vllm_multimodal_info_leak, that detects vLLM OpenAI-compatible servers affected by CVE-2026-22778. When an invalid image is sent to vLLM’s multimodal endpoint, PIL raises an error containing a heap address, which can be chained with a heap overflow to achieve RCE on the target system.
#21613 - Adds a local exploit module for DirtyClone (CVE-2026-43503).
#21750 - Adds a module targeting CVE-2026-0770, an unauthenticated remote code execution vulnerability in Langflow versions 1.7.3 and below.
#21785 - Adds the mongodb_version, mongodb_login, mongodb_schemadump, and mongodb_hashdump auxiliary modules.
#21787 - Adds an exploit module for EDB-52079, an unauthenticated remote code execution vulnerability in dizqueTV, a Node.js-based IPTV streaming server.
#21826 - Adds a new exploit module for OpenCTI that chains CVE-2026-27960 and CVE-2026-39980 to achieve unauthenticated remote command execution.
#21831 - Adds a module that exploits CVE-2026-53959, a broken access control vulnerability allowing mass user information disclosure in 4gaBoards versions 3.3.8 and below. The application’s /api/users REST endpoint lets any authenticated user retrieve a full, unpaginated list of every user in the system. Missing authorization checks allow an attacker to retrieve the email, phone, organization, name, and SSO email addresses (ssoGoogleEmail, ssoGithubEmail, and others) of every user.
#21864 - Adds a new exploit module that detects and exploits CVE-2026-0768, an unauthenticated remote code execution vulnerability impacting Langflow version 1.4.2.
#21867 - Adds a new exploit module that detects and exploits CVE-2026-0769, an unauthenticated RCE vulnerability impacting Langflow version 1.3.2.
#21877 - Adds a new exploit module that detects and exploits CVE-2026-7873, an authenticated RCE vulnerability impacting Langflow versions 1.0.0 through 1.10.0.
#21884 - Adds a sandbox escape exploit for OpenCTI’s SafeJS that achieves RCE as root inside the platform’s API container, affecting versions 6.8.16 and above.
#21890 - Adds Windows AArch64 fetch adapters.
#21896 - Adds an exploit module for CVE-2026-86218, an unauthenticated RCE against N-able N-central versions 2026.3.1.13 and below.
#21901 - Adds an authenticated exploit module for CVE-2024-9264, a DuckDB command injection in Grafana SQL Expressions.
#21942 - Adds a new auxiliary module that leverages CVE-2026-93680, an authentication bypass vulnerability impacting Langflow versions 1.5.0 through 1.11.4.

Enhancements and Features (3)

#21680 - Updates the post/linux/gather/enum_protections module to detect AV/EDR software on the target system.
#21935 - Adds additional fingerprint support for GitLab 19.0.0 through 19.4.0.
#21936 - Improves the msfvenom option handling error message.

Bugs Fixed (15)

Pro: Applies a routine Java update.
Pro: Fixes a crash when attempting to update a project with a previously deleted owner.
#21490 - Fixes a crash when fingerprinting HTTP services that contained null bytes.
#21548 - Adds documentation and improves reliability for fileless fetch payloads using the shell-search option on systems where anonymous file handles either don’t exist, or where the current user does not have permission to write the payload into them.
#21878 - Fixes search type:-aux so the aux shorthand correctly excludes auxiliary modules, matching the behavior of search type:-auxiliary.
#21882 - Fixes some exists? checks to now more accurately check for .directory? in several modules.
4ae92b6 - Fixes a crash when downloading the issued certificate in AD CS Web Enrollment.
#21923 - Fixes some exists? checks to now more accurately check for .directory? and writable? in several modules.
#21959 - Fixes missing ip:port prefixes for the console output in the MSSQL and SSH login scanners.
#21969 - Freezes time in the rate limiter concurrency spec.
#21979 - Adds additional HTTP redirect checks to multiple modules.
#21982 - Fixes duplicate ip:port prefixes in the output of the PostgreSQL login scanner.
#21994 - Adds additional FTP PASV IP validation checks to multiple modules.
#22002 - Fixes leaking TCP sockets and file descriptors when the MSSQL Login Scanner module or the MSSQL session type is used.
#22014 - Fixes false positives in the detection logic of the auxiliary/gather/hikvision_info_disclosure_cve_2017_7921, auxiliary/gather/magento_xxe_cve_2024_34102, and auxiliary/scanner/http/elasticsearch_traversal modules.

Offline Update

https://updates.metasploit.com/packages/9619ebed1a046669c73a37798d9c97bc3e0eeaaa44eaf8f9652da79cdc0ad282.bin

Metasploit Framework and Pro Installers

https://github.com/rapid7/metasploit-framework/wiki/Downloads-by-Version