Issues

• ARCH_ALL payloads get incorrectly included for modules that only support JSP payloads

  bug
  rapid7/metasploit-framework#22101 · Filter by author jheysel-r7 opened on Nov 4, 2026

• Metasploit module for CVE-2026-21589: Critical unauthenticated arbitrary file access in Atlassian products

  suggestion-module
  rapid7/metasploit-framework#22089 · Filter by author cdelafuente-r7 opened on Nov 2, 2026
  1

  

• stdapi extension fails to load on PHP Meterpreter in 2.0.247 (core_loadlib no response)

  bug
  rapid7/metasploit-framework#22066 · Filter by author 0xAnk opened on Oct 26, 2026
  8

  

• Add NTLM Signing and Seal Bypass functionality

  suggestion-feature
  rapid7/metasploit-framework#22048 · Filter by author jheysel-r7 opened on Oct 23, 2026
  

• Incorrect default FETCH_COMMAND value for FTP fetch payloads.

  bugeasy
  rapid7/metasploit-framework#22047 · Filter by author bwatters-r7 opened on Oct 23, 2026
  2

• Help out with Windows 10x86 targets on Eternalblue (MS17-010)

  suggestion-module
  rapid7/metasploit-framework#22046 · Filter by author bwatters-r7 opened on Oct 23, 2026
  2

• Addition of exploit module - PHP2Shell - CVE-2026-109618

  suggestion-module
  rapid7/metasploit-framework#22034 · Filter by author bhaskarbhar opened on Oct 21, 2026
  1

• Be consistently inconsistent in documentation

  bug
  rapid7/metasploit-framework#22032 · Filter by author bwatters-r7 opened on Oct 20, 2026
  6

  

• saltstack_salt.rb requires peer prefix cleanup and cmd_exec API migration

  rapid7/metasploit-framework#22012 · Filter by author AleksaZatezalo opened on Oct 13, 2026

• Refactor and centralize self-signed certificate generation across Framework

  suggestion-feature
  rapid7/metasploit-framework#22011 · Filter by author cdelafuente-r7 opened on Oct 12, 2026
  4

• Fix DirtyClone Description

  bug
  rapid7/metasploit-framework#21999 · Filter by author bwatters-r7 opened on Oct 8, 2026
  1

• Proxy support fails to use IPv6 proxies to reach legacy targets

  bug
  rapid7/metasploit-framework#21978 · Filter by author jpatw opened on Oct 6, 2026
  1

• Duplicate ip:port prefixes in some scanner modules

  bug
  rapid7/metasploit-framework#21974 · Filter by author cgranleese-r7 opened on Oct 5, 2026
  9

• CVE-2026-3180 - WordPress Contest Gallery <= 28.1.4 Unauthenticated Blind SQLi

  suggestion-module
  rapid7/metasploit-framework#21972 · Filter by author 4ravind-b opened on Oct 4, 2026

• Add Support for ESC_CES: NTLM Relay to Certificate Enrollment Services

  suggestion-module
  rapid7/metasploit-framework#21958 · Filter by author jheysel-r7 opened on Sep 30, 2026
  

• gemtek_cpe7000 (EDB-39726) — payload.encoded_exe returns nil on current framework

  questionStale
  rapid7/metasploit-framework#21952 · Filter by author twomack-star opened on Sep 28, 2026
  1

• Add HTTPS support to the streamable HTTP MCP transport

  suggestion-feature
  rapid7/metasploit-framework#21950 · Filter by author cdelafuente-r7 opened on Sep 28, 2026
  3

  

• ExploitDarlenePRO Error: invalid format: dat

  questionStale
  rapid7/metasploit-framework#21945 · Filter by author He1pMee opened on Sep 24, 2026
  1

• New module suggestion: Arista VeloCloud Orchestrator CVE-2026-93952 (CVSS 10.0) detection + tracking

  Stale
  rapid7/metasploit-framework#21940 · Filter by author Pushpenderrathore opened on Sep 22, 2026
  2

• RPC module.execute swallows option-validation failures for exploit/evasion, returning a 200 {job_id: nil, uuid: nil} with no structured error (unlike the auxiliary branch)

  bug
  rapid7/metasploit-framework#21927 · Filter by author Panchal-Sahil opened on Sep 20, 2026
  2

• NTLM relay: identity strings keep embedded null bytes when the client negotiates UNICODE

  Stale
  rapid7/metasploit-framework#21919 · Filter by author Pushpenderrathore opened on Sep 19, 2026
  1

• Add msftidy_docs to autorun

  rapid7/metasploit-framework#21872 · Filter by author bwatters-r7 opened on Sep 3, 2026
  5

  

• Add DeFangedMode documentation check

  rapid7/metasploit-framework#21871 · Filter by author bwatters-r7 opened on Sep 3, 2026
  3

• ENH: Exploit module for Langflow Authenticated Remote Code Execution vulnerability CVE-2026-5027

  suggestion-feature
  rapid7/metasploit-framework#21855 · Filter by author rmhowe425 opened on Sep 1, 2026

• ENH: Exploit module for Langflow Authenticated Remote Code Execution vulnerability CVE-2026-19286

  suggestion-module
  rapid7/metasploit-framework#21844 · Filter by author rmhowe425 opened on Aug 29, 2026