Rapid7 reports new Metasploit modules for Citrix NetScaler, Flowise, SPIP

What happened

Rapid7 reports that its weekly Metasploit Framework release, published 2026-11-06, adds 13 new modules. Rapid7 describes several of them as unauthenticated remote code execution modules for network perimeter devices, naming Citrix NetScaler and Cisco Secure Email Gateway Rapid7. Metasploit modules are tools for penetration testing. A module being published does not mean a product has been attacked.

According to Rapid7, the release includes:

• Citrix NetScaler: an exploit module for an unauthenticated command injection in login logging that leads to remote code execution. Rapid7 says the vendor reported this flaw as exploited in the wild before public disclosure. The Rapid7 entry is inconsistent about the CVE ID. The module title cites CVE-2026-88771, while its CVE reference field lists CVE-2026-88773. Which ID is correct is not confirmed. Affected NetScaler versions are not confirmed in the source.
• Cisco Secure Email Gateway: Rapid7 mentions an unauthenticated RCE module in its introduction. CVE, versions and other details are not confirmed in the available text.
• GitLab CI/CD: Rapid7 describes an authenticated regular expression integer overflow RCE module. CVE and affected versions are not confirmed in the available text.
• Flowise: an auxiliary module for CVE-2025-58434. Rapid7 says it is an unauthenticated account takeover affecting versions 3.0.5 and earlier. According to Rapid7, the password reset API returns a valid reset token in its response, so the password of any account with a known email address can be reset.
• SPIP: an auxiliary module for an authorization flaw (IDOR) in password changes in SPIP before 4.4.23. Rapid7 says the issue is fixed in 4.4.23 and that no CVE had been assigned at the time of writing.
• OpenBullet2: modules for CVE-2026-25856, an RCE that abuses the plain C# execution mode, and CVE-2026-39908, which on Windows leaks the NTLMv2 hash through a malicious UNC path. Rapid7 says both are unauthenticated and affect releases from version 0.2.5. A fixed version is not confirmed.
• Portainer: an exploit module that needs valid Portainer credentials. It creates a privileged container to run commands as root on the Docker host.
• A HashiCorp Consul version scanner and a Linux ELF persistence module.

Am I affected?

Based on what Rapid7 reports, you may be affected if you run any of the following:

• Citrix NetScaler. Affected versions are not confirmed in the source.
• Cisco Secure Email Gateway. Details are not confirmed.
• GitLab with CI/CD. Affected versions are not confirmed.
• Flowise 3.0.5 or earlier.
• SPIP before 4.4.23.
• OpenBullet2 0.2.5 or later. The NTLMv2 issue is Windows only.
• Portainer, where an attacker would need valid credentials.

What to do now

1. Check the vendor advisory for Citrix NetScaler and apply any available fix. Rapid7 says the vendor reported in-the-wild exploitation, so treat exposed appliances as a priority.
2. Upgrade SPIP to 4.4.23 or later Rapid7.
3. If you run Flowise 3.0.5 or earlier, check the vendor for a fixed release. A fixed version is not confirmed in the source.
4. If you run OpenBullet2, check the project for fixes. Avoid exposing it without authentication.
5. For Cisco Secure Email Gateway and GitLab CI/CD, check the vendor security advisories directly. The source does not confirm the details.
6. Review Portainer accounts and credentials, since that module needs valid logins.

Sources

• Rapid7: Metasploit Wrapup: Unauth RCE modules in Network Perimeter Devices and much more