Loading story…
Rapid7 developers added and refined a Metasploit module for CVE-2026-41477, an unauthenticated IPC named pipe local privilege escalation flaw in Deskflow. The work tracks exploit support for a vulnerability that could allow a local attacker to elevate privileges through Deskflow's inter-process communication mechanism, and the issue was added to the Metasploit project workflow for further development.
The updated module was reworked to use direct kernel32 Railgun API calls for named pipe communication instead of cmd_exec and PowerShell wrappers, while also replacing PowerShell-based environment variable expansion with native path expansion. Developers removed the WMI launcher and intermediate PowerShell scripts, limited the module to Meterpreter sessions because Railgun is required, and added documentation with verified scenario output as the exploit support matured.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Development updates rewrote the module to use direct kernel32 Railgun API calls for named pipe communication, removed PowerShell and WMI-based components, restricted use to Meterpreter sessions, and added documentation with verified scenario output. The related pull request activity was published on April 23, 2026.
A pull request was opened to add support in Metasploit for CVE-2026-41477, described as an unauthenticated IPC named pipe local privilege escalation vulnerability in Deskflow. Project activity shows the item being added to the Metasploit Kanban board and moved to the Todo column.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rapid7 released a Metasploit update adding **seven new modules** plus multiple enhancements and fixes, including new exploit support for high-severity vulnerabilities affecting AI infrastructure, remote access appliances, and VoIP devices. The release highlights an Ollama model registry path traversal chain (**CVE-2024-37032**, CVSS 8.8) that abuses the `pull` mechanism to achieve arbitrary file write and escalate to **unauthenticated root RCE**, and a Grandstream GXP1600 stack overflow (**CVE-2026-2329**, CVSS 9.3) that can yield a root session and is paired with post-exploitation capabilities such as credential harvesting and SIP traffic interception/proxying. The update also adds/updates an exploit for **BeyondTrust Privileged Remote Access (PRA) / Remote Support (RS)** appliances via **unauthenticated command injection** (**CVE-2026-1731**, CVSS 9.9), and introduces a BeyondTrust helper library to support future module development and port existing modules. On the evasion side, Metasploit gained a Linux ARM64 RC4 “packer” module (`linux/aarch64/rc4_packer`) featuring in-memory ELF execution and sleep-based evasion, while several existing modules and auxiliary scanners received quality-of-life improvements and bug fixes (e.g., improved checks and reduced false positives/crashes).
Jun 29, 2026
Rapid7 submitted a Metasploit module for **Ivanti Connect Secure** that targets the chained vulnerabilities `CVE-2023-46805` and `CVE-2024-21887`, a combination widely associated with remote code execution on exposed appliances. The pull request indicates offensive security tooling has been updated to support exploitation of the authentication bypass and command injection chain, lowering the barrier for defenders and attackers alike to reproduce the issue in testing or live environments. A separate GitHub reference shows ProjectDiscovery adding a Nuclei template for `CVE-2025-4665`, identified as a **SQL injection** flaw in the **WordPress CFDB7** plugin. While the available material does not include exploitation details or patch guidance, both references show public security tooling rapidly incorporating newly disclosed vulnerabilities, increasing the urgency for organizations to identify exposed Ivanti gateways and vulnerable WordPress installations and apply mitigations or updates.
Jun 29, 2026
**CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog**, including a critical **SolarWinds Web Help Desk (WHD)** security protection bypass tracked as `CVE-2025-40536` (CVSS 9.8). The issue stems from flawed CSRF-check logic that relies on a whitelist of query parameters, which can be bypassed with crafted URI parameters to reach restricted functionality without authentication; SolarWinds patched the flaw in *WHD 2026.1*. CISA set an accelerated remediation deadline for U.S. Federal Civilian Executive Branch agencies, and Microsoft separately reported an active campaign targeting SolarWinds WHD but did not confirm whether `CVE-2025-40536` was the specific vulnerability exploited. Rapid7 reported that **Metasploit added exploit module support for SolarWinds WHD vulnerabilities `CVE-2025-40536` and `CVE-2025-40551`**, enabling post-exploitation sessions running as `NT AUTHORITY\SYSTEM` when successful. This increases operational risk for unpatched environments by lowering the barrier to exploitation and reinforces the urgency of applying SolarWinds’ available fixes and validating exposure of WHD instances, particularly those reachable from untrusted networks.
Jun 29, 2026