Metasploit Wrap Up: Lot of summer shells and fit http profiles

1. Executive summary

Rapid7 added public Metasploit modules for multiple unauthenticated and authenticated remote-code-execution paths, a Linux local privilege escalation, and Ray Dashboard directory traversal; it also added malleable Meterpreter HTTP(S) profiles and Windows-on-ARM reverse-TCP payloads. The immediately prioritised set is CVE-2026-63030 (CVSS 9.8 CRITICAL, IN CISA KEV; added 2026-07-21), CVE-2026-33017 (CVSS 9.3 CRITICAL, IN CISA KEV; added 2026-03-25), CVE-2026-15409 (CVSS 10.0 CRITICAL, IN CISA KEV; added 2026-07-14), CVE-2026-60137 (CVSS 5.9 MEDIUM, IN CISA KEV; added 2026-07-21), and CVE-2026-48907 (CVSS 10.0 CRITICAL, IN CISA KEV; added 2026-06-16). The other verified issues are CVE-2025-49132 (CVSS 10.0 CRITICAL, NOT in CISA KEV), CVE-2026-27760 (CVSS 9.2 CRITICAL, NOT in CISA KEV), CVE-2026-46300 (CVSS 7.8 HIGH, NOT in CISA KEV), CVE-2026-22594 (CVSS 8.1 HIGH, NOT in CISA KEV), and CVE-2026-29053 (CVSS 7.6 HIGH, NOT in CISA KEV). Rapid7 also lists Pix for WooCommerce CVE-2026-3891 without supplied verified scoring or KEV data, and a Ray issue with no assigned CVE; neither is severity-ranked here. Public modules reduce exploitation effort, but this release is not evidence that a specific EMEA financial institution was targeted or compromised.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The source documents exploit-tool availability rather than a client incident or affected regulated service; it also does not establish engagement of UK NIS 2018: UK Network and Information Systems Regulations — OES/RDSP duties.

3. Technical analysis & attack chain

Rapid7 describes 13 new modules and payload additions. The module-specific mechanisms and affected-version claims below are single-sourced to Rapid7; verify product applicability before enforcement. CISA KEV status independently establishes known exploitation for the five marked entries, but does not show that the new Metasploit modules were used in those incidents.

The Ray Dashboard module has no CVE. Rapid7 states that it traverses paths through the logs API to list local-directory contents; CVE issuance was pending at publication.

Confirmed exploit-module workflows

1. WordPress WP2Shell chain
2. An unauthenticated attacker reaches an affected WordPress core version.
3. CVE-2026-63030 causes REST API route confusion.
4. CVE-2026-60137 supplies the SQL-injection step used to elevate privileges.
5. The module deploys its payload as a custom plugin and starts a remote session.

Rapid7 supplies no exact request, plugin name, filename or post-exploitation command.

2. Langflow
3. An unauthenticated attacker reaches /api/v1/build_public_tmp/{flow_id}/flow on Langflow before 1.9.0.
4. The module triggers the CVE-2026-33017 code-injection condition and obtains remote execution.

No executed command, dropped file, callback destination or persistence action is supplied.

3. SonicWall SMA1000
4. The attacker reaches the WorkPlace wsproxy service.
5. CVE-2026-15409 supplies an SSRF primitive which Rapid7’s module presents as remote command execution.

Rapid7 does not disclose the internal SSRF destination, request format, fetched resource, command path or payload.

Post-exploitation and payload considerations

• The Joomla JCE module writes a PHP web shell into tmp/; continued access depends on that directory remaining directly web-accessible.
• The WordPress chain leaves a custom plugin payload. No plugin name or filesystem path is supplied.
• CVE-2026-46300 is local privilege escalation and therefore requires prior local execution; it does not itself provide initial access.
• The new MALLEABLEC2 option can change the appearance of Meterpreter HTTP(S) traffic across Windows, Java, Python, PHP and Linux payloads.
• New Windows AArch64 payloads provide inline and staged reverse-TCP command shells.
• No campaign, actor, victim, C2 infrastructure, lateral movement, data theft, exfiltration or observed operational impact is documented. No attribution can be made.

4. Mitigation & containment

P1 — within 24 hours

• CVE-2026-63030 and CVE-2026-60137: upgrade WordPress to a vendor-supported build outside 6.9.0–6.9.4 and 7.0.0–7.0.1. If this cannot be completed immediately, remove affected sites from untrusted network access. Review role changes and recently installed or modified custom plugins.
• CVE-2026-33017: upgrade Langflow to 1.9.0 or later. Pending upgrade, deny untrusted access to the instance or, after application testing, /api/v1/build_public_tmp/{flow_id}/flow.
• CVE-2026-15409: identify every SMA1000 appliance exposing WorkPlace wsproxy; restrict it to required trusted sources or remove it from service pending a vendor-validated fixed build. Rapid7 supplies no fixed version.
• CVE-2026-48907: upgrade JCE to a vendor-validated fixed release later than 2.9.99.4 or disable the extension. Deny direct HTTP access to tmp/ and inspect that directory for unexpected PHP content before removal or restoration.
• Preserve proxy, web, application, authentication and relevant filesystem telemetry before remediation.

P2 — within 72 hours

• CVE-2025-49132: upgrade Pterodactyl Panel to 1.11.11 or later; examine locale.json activity and files unexpectedly created by the web-server account.
• Ghost CMS: reconcile CVE-2026-22594 versus CVE-2026-29053 against the applicable vendor advisory before closing remediation. Restrict theme upload and activation to trusted administrators and review recently activated themes for untrusted JSONPath expressions used through {{#get}}.
• CVE-2026-27760: remove OpenCATS from untrusted network access and apply a vendor-confirmed fix; no fixed version is supplied.
• CVE-2026-46300: deploy a distribution kernel explicitly marked fixed for the CVE. Until then, reduce untrusted local execution opportunities; do not infer a safe kernel version from this advisory.
• Ray Dashboard: restrict Dashboard and logs-API access to a trusted management network and review directory-listing activity.
• CVE-2026-3891: confirm the affected Pix for WooCommerce versions and fixed release with the vendor. Disable or isolate the plugin if its exposure cannot be validated.

P3 — within 7 days

• Run the §6 detections in monitor-only mode and correlate results with application and host telemetry.
• Retrospectively review WordPress privilege changes and custom-plugin deployment, JCE profile imports and tmp/ writes, Ghost theme activation, Pterodactyl file creation, and Langflow endpoint access.
• Confirm EDR and network telemetry coverage for Windows AArch64 systems.
• Validate egress controls for unexpected reverse-TCP sessions and anomalous Meterpreter-like HTTP(S), recognising that MALLEABLEC2 can alter traffic appearance.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

6. Detection

The following rules detect access to the exact Langflow route identified by Rapid7, not successful exploitation. Scope the YARA rule to raw HTTP requests or captured traffic; applying it broadly to documents will also match reporting.

rule AT_Langflow_Public_Tmp_Flow_Endpoint_20260816
{
    meta:
        author = "Adverse Trace"
        date = "2026-08-16"
        reference = "https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-lot-of-summer-shells-and-fit-http-profiles"
        description = "Detects the Langflow public temporary flow endpoint associated with CVE-2026-33017"

    strings:
        $endpoint_prefix = "/api/v1/build_public_tmp/" ascii
        $endpoint_suffix = "/flow" ascii

    condition:
        $endpoint_prefix and $endpoint_suffix
}

Map the Sigma url field to the local web, proxy or WAF URI-path field.

title: Access to Langflow Public Temporary Build Flow Endpoint
status: experimental
description: Detects access to the endpoint identified for the Langflow unauthenticated RCE module; access alone does not prove exploitation.
references:

  - https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-lot-of-summer-shells-and-fit-http-profiles
author: Adverse Trace
date: 2026-08-16
logsource:
  category: webserver
detection:
  selection:
    url|contains: '/api/v1/build_public_tmp/'
    url|endswith: '/flow'
  condition: selection
falsepositives:

  - Legitimate Langflow build activity
level: medium

CVE assessment

10 referenced CVEs — 5 actively exploited (CISA KEV), 6 critical (CVSS ≥ 9.0)

7. Sources

• Rapid7 — “Metasploit Wrap Up: Lot of summer shells and fit http profiles” — source — 2026-08-14.
• NIST NVD — National Vulnerability Database, CVSS/CWE reference data — source — snapshot supplied 2026-08-16.
• CISA — Known Exploited Vulnerabilities Catalog — source — snapshot supplied 2026-08-16.
• FIRST — Exploit Prediction Scoring System — source — snapshot supplied 2026-08-16.

8. Adverse Trace position

Adverse Trace does not assign one blanket severity to this roundup. Priority is driven by CVE-2026-63030 (CVSS 9.8 CRITICAL, IN CISA KEV), CVE-2026-33017 (CVSS 9.3 CRITICAL, IN CISA KEV), CVE-2026-15409 (CVSS 10.0 CRITICAL, IN CISA KEV), CVE-2026-60137 (CVSS 5.9 MEDIUM, IN CISA KEV), and CVE-2026-48907 (CVSS 10.0 CRITICAL, IN CISA KEV). CVE-2025-49132 (CVSS 10.0 CRITICAL), CVE-2026-27760 (CVSS 9.2 CRITICAL), CVE-2026-46300 (CVSS 7.8 HIGH), CVE-2026-22594 (CVSS 8.1 HIGH), and CVE-2026-29053 (CVSS 7.6 HIGH) are NOT in CISA KEV. Client impact depends on product presence, exposure and patch state; the release of working Metasploit modules increases operational accessibility but does not prove client exploitation. The module mechanics and behavioural indicators are single-sourced to Rapid7—verify before enforcement—and no actor attribution is available. Adverse Trace will monitor vendor remediation details, the unresolved Ghost CVE mapping, Ray CVE assignment, authoritative data for CVE-2026-3891, and any corroborated infrastructure or payload indicators.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.