Metasploit Wrap Up 05/29/2026

More Linux LPEs

Hark the age of the Linux LPE has arrived. This week’s release follows up on recent work bringing new Linux LPEs to Metasploit users. Copy Fail seemed to have kicked off a trend of similar bugs and hot on its heels is Dirty Frag. Dirty Frag is actually two vulnerabilities in a trenchcoat, individually identified as CVE-2026-43284 and CVE-2026-43500. Each is exploitable individually and comes with a new Metasploit module.

New module content (5)

Citrix ADC (NetScaler) CVE-2026-3055 Scanner

Authors: sfewer-r7 and watchTowr

Type: Auxiliary

Pull request: 

Path: scanner/http/citrix_netscaler_cve_2026_3055

AttackerKB reference:  contributed by  contributed by 

Description: Adds two new local privilege escalation modules for the "DirtyFrag" Linux kernel vulnerabilities. The first targets CVE-2026-43284, a page-cache write vulnerability in the xfrm/ESP fragmentation path. The second targets CVE-2026-43500, a page-cache corruption vulnerability in the RxRPC/rxkad subsystem.

Dompdf RCE via Malicious Font Caching (CVE-2022-28368)

Authors: Adithya Pawar, Fabian Bräunlein, Maximilian Kirchmeier, msutovsky-r7, and rvizx

Type: Exploit

Pull request: 

Path: multi/http/dompdf_rce_cve_2022_28368

AttackerKB reference:  contributed by 

Description: This adds a module to exploit CVE-2026-4257 resulting in remote code execution on Wordpress sites with the Contact Form by Supsystic plugin. Contact Form plugin versions 1.7.36 and before are vulnerable.

Bugs fixed (4)

•  - This refines our smb_to_ldap relay attack reporting by demoting anonymous authentication messages from print_good to print_status, reflecting that anonymous sessions do not grant additional privileges. It also skips the #on_relay_success callback for these sessions to prevent modules from needlessly acting on unprivileged access.
•  - This bumps the Metasploit-credentials gem to address an issue in how Kerberos hashes were being handled.
•  - Fixes MCP server test failure.
•  - Updates to a newer version of RubyZip to support Zip files larger than 4GB.

Documentation

You can find the latest Metasploit documentation on our docsite at