Rapid7’s weekly Metasploit update brings four new detection modules and several improvements to the framework. If you’re running any of these tools, pay attention.
The headline addition is an exploit module for Dalfox Server (CVE-2026-45087) – an unauthenticated remote code execution affecting versions up to 2.12.0. Attackers can send arbitrary commands through the “found-action” POST parameter, which gets deserialized and executed in the context of the server user. There’s no auth required.
Three new scanners round out the release. The Audiobookshelf module detects CVE-2025-25205, an unauthenticated API bypass in self-hosted audiobook and podcast servers running versions 2.17.0 through 2.19.0. The fix landed in 2.19.1.
The LiteLLM scanner covers CVE-2026-42208 – a pre-authentication SQL injection with a CVSS score of 9.3. This one’s on the CISA KEV list, which means it’s being actively exploited in the wild. If you’re running a BerriAI LiteLLM proxy, patch now.
Finally, there’s a Next.js Middleware Authorization Bypass scanner for CVE-2025-29927 (CVSS 9.1). It affects self-hosted Next.js applications and could let attackers skip authorization checks entirely.
Rapid7 is also soliciting feedback on proposed changes to Metasploit’s evasion capabilities. The feedback form closes July 1, 2026.
