Metasploit Wrap Up: This One Goes to Sixteen!

1. Executive summary

Rapid7's Metasploit wrap-up of 2026-09-11 adds sixteen modules, ten of them weaponised exploits, five targeting CVEs on the CISA KEV list: Cisco Secure Firewall Management Center (CVE-2026-20079, CVSS 10.0 CRITICAL), SonicWall SMA1000 (CVE-2026-83548 CVSS 10.0 CRITICAL and CVE-2026-83549 CVSS 7.8 HIGH), JetBrains TeamCity (CVE-2026-63077, CVSS 9.8 CRITICAL) and PaperCut MF/NG (CVE-2026-82078, CVSS 9.4 CRITICAL). Public exploit code now exists for all five, materially lowering the barrier for opportunistic and targeted attacks against these products. EMEA financial services running any of the affected perimeter, CI or print-management products should treat this as an immediate patch-and-verify event, prioritising the KEV-listed items.

2. Regulatory framing

No specific NIS2 article is directly engaged by this item beyond generic patching obligations.

3. Technical analysis & attack chain

This is a tooling release, not a single intrusion — the attack chains below are the exploit chains the new modules implement, per the source.

Prioritised triage table (KEV first, then EPSS descending):

Full mechanism depth — the three most urgent chains

1. SonicWall SMA1000 SSRF-to-root chain (CVE-2026-83548 → SMA1000-9427 → CVE-2026-83549). Disclosed in the first week of September 2026 as exploited in the wild. Stage one: CVE-2026-83548 is an SSRF in the WorkPlace wsproxy service used to bypass authentication. Stage two: SMA1000-9427 provides low-privileged RCE via CouchDB read/write primitives. Stage three: CVE-2026-83549 is OS command injection in cmsSnmpTrap.sh, yielding RCE as root. The Metasploit module linux/http/sonicwall_sma1000_couchdb_rce (PR #21883) implements the chain. The source states patched version 12.5.0-02952 has been verified to remediate the full chain. Note: the verified reference data classifies CVE-2026-83548 as CWE-441/CWE-918 (SSRF), consistent with the source's SSRF description.

2. JetBrains TeamCity unauthenticated RCE (CVE-2026-63077). The module multi/http/jetbrains_teamcity_rce_cve_2026_63077 (PR #21775) exploits an unsafe XStream deserialization flaw in the agent polling protocol. The attack chain: (1) the attacker registers a fake build agent against the TeamCity server's agent-polling endpoint; (2) the crafted XStream payload deserialises on the server; (3) a one-shot JSP payload is written and executed on the server; (4) the module's cleanup logic automatically unregisters and removes the fake build agent to reduce forensic footprint. Both Windows and Linux TeamCity targets are supported. EPSS is 87% — the highest in this release — and the CVE has been in CISA KEV since 2026-08-05.

3. Cisco FMC unauthenticated auth bypass → RCE (CVE-2026-20079). The module linux/http/cisco_fmc_auth_bypass_rce (PR #21796) implements an unauthenticated authentication bypass in Cisco Secure Firewall Management Center, chained to remote code execution. CVSS 10.0, KEV-added 2026-09-09 (two days before this advisory), EPSS 76%. The source gives no further mechanism detail; treat the precise bypass path as single-sourced pending Cisco's advisory.

Other notable items, in brief

• PaperCut MF/NG chain (CVE-2026-81578 + CVE-2026-82078) — module multi/http/papercut_ng_external_user_lookup_rce (PR #21842). Reported last week as a zero-day actively exploited in the wild. CVE-2026-82078 is CWE-470 (Unsafe Reflection), CVSS 9.4, KEV-added 2026-08-31. The source names no patched version; check vendor advisories.
• MCPJam Inspector unauthenticated command execution (CVE-2026-23744) — module multi/http/mcpjam_inspector_rce (PR #21834). The /api/mcp/connect endpoint accepts a JSON serverConfig object containing a command and args array, which are used to start an MCP server. When MCPJam Inspector is exposed on a routable interface, an unauthenticated remote attacker executes OS commands as the MCPJam process user.
• Apache Tika XFA XXE via Elasticsearch ingest-attachment (CVE-2025-66516 / CVE-2025-54988) — scanner module scanner/http/elasticsearch_tika_xfa_xxe (PR #21739). Validates an XXE flaw in Tika's XFA parser exposed through the Elasticsearch attachment ingest processor, enabling local file read. Both CVEs are CVSS 8.4 HIGH, not in KEV, but EPSS 88% and 38% respectively.
• ESC8 Kerberos relay (CVE-2026-20929) — module server/relay/esc8_kerberos (PR #21709). Captures an SMB2 AP-REQ from a coerced client and replays it to the AD CS Web Enrollment (ESC8) certificate server over HTTP, issuing a certificate for the coerced victim and obtaining a valid Kerberos TGT without their credentials.
• Langflow authenticated RCE (CVE-2026-19295) — module multi/http/langflow_auth_rce_cve_2026_19295 (PR #21837), affecting Langflow 1.10.0 and below.
• SPIP unauthenticated RCE (no CVE yet) — module multi/http/spip_autosave_rce (PR #21859), affecting SPIP ≤ 4.4.21. The action=session endpoint lets any visitor store arbitrary PHP code in a session variable via the forum autosave handler; the template engine executes it when the article page renders.
• SimpleHelp OIDC auth bypass (CVE-2026-48558) — module multi/http/simplehelp_oidc_auth_bypass_rce (PR #21825), affecting SimpleHelp 5.5.0–5.5.15. Not in the verified reference data; severity unassessed here.
• Next.js RCE on Windows (CVE-2026-75604) — module windows/http/nextjs_unauth_rce_cve_2026_75604 (PR #21834), affecting Next.js 13.4.0–15.5.24 and 16.0.0–16.3.3. Not in the verified reference data; severity unassessed here.
• SPIP blind SQLi — scanner scanner/http/spip_annee_sqli (PR #21791), blind SQL injection in SPIP's date column escaping logic. No CVE.
• New persistence/evasion tooling — windows/persistence/boot_verification_program (registry key BootVerificationProgram), windows/persistence/time_provider (custom Time Provider DLL under the W32Time service registry key), and linux/x64/sandbox_gate (runtime sandbox/VM checks, aborts on detection). These are offensive capability additions relevant to threat hunting, not vulnerabilities.
• Defender-relevant scanner — scanner/msf/handler_detect (PR #21551) enumerates ports to identify Metasploit reverse handlers and the shell type they would deliver; useful for blue teams auditing their own exposure.

Confidence caveat: All technical detail above is single-sourced (Rapid7's wrap-up blog and the linked Metasploit pull requests). The "exploited in the wild" claims for SonicWall SMA1000 and PaperCut are the source's characterisation of prior vendor disclosure; verify against the original vendor advisories before enforcement action.

4. Mitigation & containment

P1 — within 24 hours

1. SonicWall SMA1000: Upgrade to 12.5.0-02952 or later — the source states this version is verified to remediate the full SSRF-to-root chain (CVE-2026-83548 / SMA1000-9427 / CVE-2026-83549). Until patched, restrict management and WorkPlace wsproxy access to trusted admin networks only; hunt for unexpected CouchDB reads/writes and execution of cmsSnmpTrap.sh outside normal SNMP trap handling.
2. Cisco FMC (CVE-2026-20079): Apply Cisco's fix. Restrict FMC management-plane access to dedicated management VLANs/jump hosts; the exploit is unauthenticated, so any reachable FMC is exposed. Review FMC authentication logs for anomalous management logins.
3. JetBrains TeamCity (CVE-2026-63077): Patch to the vendor-fixed version. Audit build-agent registrations for unknown/unauthorised agents and the web root for unexpected one-shot JSP files; the module's cleanup logic means absence of a fake agent is not evidence of no exploitation — check historical agent-registration logs.
4. PaperCut MF/NG (CVE-2026-81578 + CVE-2026-82078): Apply vendor patches for both CVEs. Restrict the external user lookup functionality and admin web interface; review for exploitation indicators from the past weeks given confirmed in-the-wild activity.

P2 — within 72 hours

5. MCPJam Inspector (CVE-2026-23744): Remove from routable interfaces immediately — the exploit is unauthenticated command execution. If required internally, bind to loopback/VPN-only access and patch.
6. Elasticsearch ingest-attachment / Apache Tika (CVE-2025-66516, CVE-2025-54988): Upgrade Tika to a fixed release; EPSS 88% on CVE-2025-66516 warrants prompt action. Restrict which indices/processors accept untrusted attachments.
7. Langflow ≤ 1.10.0 (CVE-2026-19295): Upgrade beyond 1.10.0; enforce authentication and network segmentation on any Langflow deployment.
8. SimpleHelp 5.5.0–5.5.15 (CVE-2026-48558): Upgrade beyond 5.5.15.
9. AD CS (ESC8 / CVE-2026-20929): Where Web Enrollment is not required, disable it; enable the certificate-services StrongCertificateBindingEnforcement protections per Microsoft ESC8 guidance and audit for coerced-authentication patterns (PetitPotam-style) followed by certificate enrollment.

P3 — within 7 days

10. SPIP: Upgrade beyond 4.4.21 (unauthenticated RCE via action=session, no CVE yet) and review the blind SQLi in date column escaping; patch per SPIP advisories.
11. Next.js on Windows (CVE-2026-75604): Upgrade from affected ranges (13.4.0–15.5.24, 16.0.0–16.3.3) to fixed releases.
12. Threat-hunt additions: Hunt for the new persistence mechanisms — BootVerificationProgram registry key modifications and unexpected Time Provider DLLs under the W32Time service registry key — and for Linux payloads exhibiting sandbox-evasion abort behaviour.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

6. Detection

rule METASPLOIT_SPIP_AUTOSAVE_SESSION_RCE
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-11"
        reference = "https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-goes-to-sixteen"
        description = "Detects SPIP forum autosave session-handler RCE payload: arbitrary PHP stored via action=session and executed by template engine (SPIP <= 4.4.21)"
    strings:
        $sess1 = "action=session" ascii
        $sess2 = "autosave" ascii
        $sess3 = "<?php" ascii
    condition:
        all of them
}

rule METASPLOIT_MCPJAM_CONNECT_SERVERCONFIG
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-11"
        reference = "https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-goes-to-sixteen"
        description = "Detects MCPJam Inspector /api/mcp/connect exploit payload carrying a serverConfig JSON object with command and args array (CVE-2026-23744)"
    strings:
        $ep    = "/api/mcp/connect" ascii
        $cfg   = "serverConfig" ascii
        $cmd   = "\"command\"" ascii
        $args  = "\"args\"" ascii
    condition:
        all of them
}

rule METASPLOIT_TEAMCITY_AGENT_POLLING_XSTREAM
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-11"
        reference = "https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-goes-to-sixteen"
        description = "Detects JetBrains TeamCity agent-polling XStream deserialization exploit payload (CVE-2026-63077): fake agent registration with one-shot JSP payload"
    strings:
        $xstream = "<java.util.PriorityQueue" ascii
        $jsp     = ".jsp" ascii
        $poll    = "agent" ascii
    condition:
        $xstream and $jsp and $poll
}

title: Suspicious SPIP action=session request with PHP payload
id: 00000000-0000-0000-0000-000000000857
status: experimental
description: Detects unauthenticated SPIP forum autosave session-handler exploitation storing arbitrary PHP code via action=session (SPIP <= 4.4.21, no CVE assigned)
references:

    - https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-goes-to-sixteen
author: Adverse Trace
date: 2026-09-11
logsource:
    category: webserver
detection:
    selection_uri:
        cs-method: 'POST'
        c-uri|contains: 'action=session'
    selection_payload:

        - c-uri|contains: '<?php'
        - sc-status:
            - 200
    condition: selection_uri and 1 of selection_payload
falsepositives:

    - Legitimate autosave plugin usage on SPIP installations
level: high

title: MCPJam Inspector /api/mcp/connect with command in serverConfig
id: 00000000-0000-0000-0000-000000000858
status: experimental
description: Detects unauthenticated command execution via MCPJam Inspector /api/mcp/connect accepting serverConfig with command/args (CVE-2026-23744)
references:

    - https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-goes-to-sixteen
author: Adverse Trace
date: 2026-09-11
logsource:
    category: webserver
detection:
    selection:
        c-uri|contains|all:

            - '/api/mcp/connect'
            - 'serverConfig'
            - 'command'
    condition: selection
falsepositives:

    - Legitimate MCP server configuration via the API by authorised operators
level: critical

title: BootVerificationProgram registry persistence
id: 00000000-0000-0000-0000-000000000859
status: experimental
description: Detects modification of the BootVerificationProgram registry key, used by the new Metasploit windows/persistence/boot_verification_program module
references:

    - https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-goes-to-sixteen
author: Adverse Trace
date: 2026-09-11
logsource:
    category: registry_set
detection:
    selection:
        TargetObject|contains: 'BootVerificationProgram'
    condition: selection
falsepositives:

    - Rare legitimate use of Windows boot verification programs
level: high

title: Custom Time Provider DLL registration under W32Time
id: 00000000-0000-0000-0000-000000000860
status: experimental
description: Detects registration of a custom Time Provider DLL under the W32Time service registry key, used by the new Metasploit windows/persistence/time_provider module
references:

    - https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-goes-to-sixteen
author: Adverse Trace
date: 2026-09-11
logsource:
    category: registry_set
detection:
    selection:
        TargetObject|contains: 'W32Time\TimeProviders'
    filter_legitimate:
        Image|endswith: '\svchost.exe'
        TargetObject|contains:

            - 'NtpClient'
            - 'NtpServer'
    condition: selection and not filter_legitimate
falsepositives:

    - Legitimate third-party time provider software installation
level: high

CVE assessment

10 referenced CVEs — 5 actively exploited (CISA KEV), 6 critical (CVSS ≥ 9.0)

7. Sources

• Rapid7 — Metasploit Wrap Up: This One Goes to Sixteen! — https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-goes-to-sixteen — 2026-09-11
• Rapid7 — Metasploit Wrap Up: Lot of summer shells and fit http profiles — https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-lot-of-summer-shells-and-fit-http-profiles (context: prior SonicWall SMA1000 wsproxy SSRF module, CVE-2026-15409)
• Rapid7 — Weekly Metasploit Update: NTLM Relay Priv Esc, MCP Server Integration, Paperclip AI RCE Chain, and more — https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-19-06-2026 (context)
• Rapid7 — Weekly Metasploit Update: Apache ActiveMQ RCE, Gogs Rebase RCE, and Windows Kernel Pointer Enum — https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-05-06-2026 (context)

8. Adverse Trace position

This release converts five KEV-listed CVEs — including two CVSS 10.0s and three confirmed in-the-wild zero-day chains (SonicWall SMA1000, PaperCut, plus Cisco FMC at KEV-added 2026-09-09) — into point-and-shoot Metasploit exploits, which materially raises the probability of opportunistic exploitation against unpatched EMEA financial-services estates in the coming weeks. The highest-EPSS items (TeamCity 87%, Tika XXE 88%, Cisco FMC 76%) deserve immediate attention regardless of KEV status. All technical detail here is single-sourced from Rapid7's blog and the underlying Metasploit pull requests; we will verify the SonicWall 12.5.0-02952 fix and the Cisco FMC patch against vendor advisories, monitor for in-the-wild exploitation reporting and any IOCs emerging from the SMA1000 and PaperCut incidents, and issue a follow-up if KEV additions or EPSS movements change the triage order.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.