Metasploit packages the SonicWall SMA1000 root chain into one module

The SonicWall chain is three weaknesses in sequence. A server-side request forgery, CVE-2026-83548, gets past authentication ^[5]. From there, CouchDB read and write primitives give code execution as a low-privileged user, tracked as SMA1000-9427 ^[6]. Root comes from CVE-2026-83549, a command injection in cmsSnmpTrap.sh ^[7]. Rapid7 credits Adam Babis, William Perry and sfewer-r7 on the module, which lands at linux/http/sonicwall_sma1000_couchdb_rce ^[3]. The post says build 12.5.0-02952 has been verified to remediate the chain ^[8].

TeamCity is the other unauthenticated path in the batch. CVE-2026-63077 is an unsafe XStream deserialization in the agent polling protocol, and the module uses it to deliver and execute a one-shot JSP payload on the server ^[9]. Windows and Linux targets are both supported, and the module unregisters and removes the fake build agent it created during exploitation ^[10]. That cleanup runs on the operator's behalf and it deletes the artifact a build administrator would check first.

The ESC8 relay module changes the framework itself. It captures an SMB2 AP-REQ from a coerced client and replays that authentication to AD CS Web Enrollment over HTTP, then issues a certificate for the victim account and obtains a valid Kerberos TGT without the victim's credentials, under CVE-2026-20929 ^[12]. Native Kerberos relaying now sits in the relay stack alongside the NTLM tooling.

Ten of the sixteen modules are exploits, and Rapid7 counts five of those against the KEV list ^[1]. Half the new exploit code therefore targets flaws CISA has already recorded as exploited ^[18]. The summary line names Cisco, PaperCut, SonicWall, JetBrains and Langflow as vendors with new exploit modules ^[2]. The mapping between those five names and the five KEV entries is Rapid7's count, not a per-CVE claim, and only the Cisco, SonicWall and JetBrains CVEs are identified in the material here: Cisco Secure Firewall Management Center gets a module for CVE-2026-20079, an unauthenticated authentication bypass ^[11].

Six of the sixteen are not exploits ^[17]. One of them, h00die's scanner/msf/handler_detect, enumerates ports on a host to work out whether they are Metasploit reverse handlers and which shell type was going to land ^[13]. Massimo Bertocchi contributed a Linux x64 evasion module that checks the runtime environment and aborts when it looks like a sandbox or VM ^[14]. Two auxiliary scanners cover file disclosure and injection: an Apache Tika XFA XXE local file read reachable through the Elasticsearch attachment ingest processor, tracked as CVE-2025-54988 and CVE-2025-66516 ^[15], and an unauthenticated blind SQL injection in SPIP's date column escaping logic ^[16].

The only in-the-wild framing in the post attaches to the SonicWall chain, disclosed in the first week of September as exploited in the wild ^[4].