Weekly Metasploit Update: NTLM Relay Priv Esc, MCP Server Integration, Paperclip AI RCE Chain, and more

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Betroffene Kennungen: CVE-2026-34413, CVE-2026-34414, CVE-2026-34415, CVE-2026-41459, CVE-2026-41679. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

This week's release includes five new modules, including a full unauthenticated RCE chain for Paperclip AI and a VS Code extension persistence technique. On the post-exploitation side, the new windows/local/ntlm_relay_2_self module coerces the local machine account to authenticate via OpenEncryptedFileRaw (WebDAV), relays that NTLM authentication to a Domain Controller's LDAP service, then uses the resulting LDAP session to write Shadow Credentials and obtain a Kerberos service ticket as Administrator via S4U2Proxy, enabling PsExec back to itself for SYSTEM access.On the enhancement side, the new MCP server plugin lets AI tools assist operators directly within a running msfconsole instance, and module check codes now return richer detail for users.New module content (5)Paperclip AI RCE using a chain of six API calls (CVE-2026-41679)Authors: Sagilayani https://github.com/sagilayani and h00die-gr3y h00die.gr3y@gmail.comType: ExploitPull request: #21547 contributed by h00die-gr3yPath: linux/http/paperclipai_unauth_rce_cve_2026_41679AttackerKB reference: CVE-2026-41679Description: Adds an exploit module for CVE-2026-41679 which exploits Paperclip. An unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in authenticated mode with default configuration. The entire chain is six API calls.Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media UploadAuthor: bootstrapbool bootstrapbool@gmail.comType: ExploitPull request: #21371 contributed …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen (CVE-2026-34413, CVE-2026-34414, CVE-2026-34415, CVE-2026-41459, CVE-2026-41679): Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-19-06-2026
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.