Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules

* New modules include a vLLM Multimodal Heap-Address Information Leak Scanner targeting CVE-2026-22778.
* A scanner for CVE-2000-0979 (SMB Share Password Enumerator) was included.
* An exploit module targets CVE-2026-86218, an unauthenticated RCE against N-able N-central.
* A local privilege escalation module targets CVE-2026-3888 in snapd via a TOCTOU race condition.
* A local exploit module for DirtyClone targeting CVE-2026-43503 was added.
* An exploit module targets CVE-2024-58286, an unauthenticated RCE against dizqueTV.
* An exploit module targets CVE-2026-0770, an unauthenticated RCE in Langflow versions less than 1.7.3.
* An exploit module targets CVE-2026-42271 for command execution in the BerriAI LiteLLM proxy's MCP endpoints.
* A sandbox escape exploit targets OpenCTI JSON Mapper safeEjs to achieve RCE as root.
* Payload adapters were added for Windows AARCH64 fetching, including cmd/windows/ftp/aarch64/exec and reverse TCP payloads over HTTP/HTTPS/TFTP.
* A module exists for Linux PAM backdoor allowing user upload into the authentication chain.
* Eight bugs were fixed, including improvements to fileless fetch payload reliability and fixes in existence checks within several modules.

The collection demonstrates a clear pattern of leveraging deep, specialized knowledge of complex software systems—ranging from large language model infrastructure (vLLM) to embedded Linux security features (snapd) and legacy SMB protocols—to create highly specific, multi-vector exploitation tools. The breadth of content suggests an underlying philosophy that mastery is achieved by connecting seemingly disparate vulnerabilities across different technological stacks. The inclusion of modules targeting both external network services (RCE in dizqueTV) and internal system boundaries (LPE in snapd) indicates a focus on bridging the gap between application-layer flaws and operating system security controls.
This pattern suggests an operational model where novel attacks are not single-vector exploits but rather chained sequences that exploit cross-system weaknesses, often relying on specific information leaks (like heap addresses) to transition from a low-level memory error to high-level execution control. The existence of modules targeting both research-adjacent flaws (CVEs from 26 years ago) and active vulnerabilities reflects an attempt to create a comprehensive knowledge base that bridges historical context with immediate operational relevance. The ongoing development, evidenced by the additions like the Novell Netware module joke, points toward a continuous drive to aggregate obscure, specialized knowledge into actionable exploits.
The implications point toward a cognitive sovereignty challenge where the value of security expertise is tied not just to knowing current defenses but to possessing the ability to navigate and exploit the historical and structural idiosyncrasies of deployed systems across diverse platforms. The costs are borne by systems that cannot account for this breadth of attack surface, while the benefit accrues to those capable of mapping these complex dependencies, reinforcing a dynamic where specialized knowledge becomes a form of asymmetric leverage in the security landscape. What assumptions about expertise lead to either hoarding or democratizing such fragmented knowledge? What mechanisms exist to ensure that this diverse skill set translates into systemic resilience rather than simply expanding offensive capability?