Metasploit 6.5.9 Wrapup: Public Exploit Modules for Citrix NetScaler (CVE-2026-88771), Cisco Secure Email Gateway (CVE-2026-76461/76443), GitLab CI/CD Regex RCE (CVE-2026-97229), OpenBullet2, Flowise, SPIP and WordPress Bug Library

Key facts for Metasploit 6.5.9 exploit modules

Detection coverage for Metasploit 6.5.9 exploit modules

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5423 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: NetScaler CVE-2026-88771 Log-Injection Command Injection (doAuthentication.do) — Exploitation

Detects exploitation of the unauthenticated Citrix NetScaler ADC/Gateway log-injection command injection (CVE-2026-88771, TL-2026-5423, public Metasploit/watchTowr exploit). Attacker-controlled input such as a username containing a semicolon is POSTed to /nf/auth/doAuthentication.do, written to a log, and later concatenated by the maintenance script ns_monuploadd_err.pl into a Perl backtick shell command, giving root command execution. The search fires on a semicolon-bearing username/login parameter, the 'pitboss PPE unexpectedly died NSPPE' marker string, or the ns_monuploadd_err.pl sink appearing in appliance syslog. CISA KEV listed and mass-exploited since 2026-09-29.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059.004
• Data sources: netscaler:citrix:netscaler:syslog, index=netscaler
• Severity: critical
• Confidence: high

Splunk SPL

index=netscaler sourcetype=citrix:netscaler:syslog earliest=-24h ("/nf/auth/doAuthentication.do" OR "pitboss PPE unexpectedly died NSPPE" OR "ns_monuploadd_err.pl")
| eval inj_semicolon=if(match(_raw, "(?i)(username|login)=[^& ]*(;|%3B)"), 1, 0)
| eval ioc_pitboss=if(like(_raw, "%pitboss PPE unexpectedly died NSPPE%"), 1, 0)
| eval ioc_sink=if(like(_raw, "%ns_monuploadd_err.pl%"), 1, 0)
| where inj_semicolon=1 OR ioc_pitboss=1 OR ioc_sink=1
| eval src_host=coalesce(src, src_ip, "unknown")
| stats count min(_time) as first_seen max(_time) as last_seen sum(inj_semicolon) as inj_hits sum(ioc_pitboss) as pitboss_hits sum(ioc_sink) as sink_hits by host, src_host
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let lookback = 24h;
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceVendor =~ "Citrix"
| where (RequestURL contains "/nf/auth/doAuthentication.do" and (RequestURL matches regex @"(?i)(;|%3b)" or Message matches regex @"(?i)(username|login)=[^& ]*(;|%3b)"))
    or Message contains "pitboss PPE unexpectedly died NSPPE"
    or Message contains "ns_monuploadd_err.pl"
    or AdditionalExtensions contains "ns_monuploadd_err.pl"
| project TimeGenerated, DeviceVendor, DeviceProduct, Computer, SourceIP, DestinationIP, RequestMethod, RequestURL, Message
| order by TimeGenerated desc

Sigma

title: Citrix NetScaler CVE-2026-88771 Log-Injection Command Injection Attempt
id: 6b0c1d4e-3f52-4a7b-9c18-5e2d7a9f4b01
status: experimental
description: Detects POST requests to the NetScaler /nf/auth/doAuthentication.do endpoint carrying shell metacharacters (semicolon) in the query, or the pitboss PPE marker string, associated with the unauthenticated log-injection command injection CVE-2026-88771 (TL-2026-5423).
references:
  - https://www.picussecurity.com/resource/blog/cve-2026-88771-citrix-netscaler-pre-auth-command-injection-explained
  - https://www.rapid7.com/blog/post/pt-metasploit-wrapup-unauth-rce-modules-in-network-perimeter-devices-and-much-more
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
  - cve.2026.88771
logsource:
  category: webserver
detection:
  selection_uri:
    cs-method: POST
    c-uri|endswith: '/nf/auth/doAuthentication.do'
  selection_inj:
    c-uri-query|contains:
      - ';'
      - '%3B'
      - '%3b'
  selection_marker:
    - 'pitboss PPE unexpectedly died NSPPE'
  condition: (selection_uri and selection_inj) or selection_marker
falsepositives:
  - Vulnerability scanners probing the NetScaler login endpoint
  - Legitimate usernames containing a semicolon (very rare)
level: high

Known false positives:

• Authorized vulnerability scanners or red-team exercises that replay the watchTowr PoC or Metasploit module against NetScaler
• Appliance syslog lines that legitimately mention ns_monuploadd_err.pl during maintenance or support diagnostics

Tuning notes: Point the index at the one that receives NetScaler syslog and confirm the sourcetype (citrix:netscaler:syslog from the Splunk Add-on for Citrix NetScaler). Exclude scanner source IPs via a lookup. Any hit on the pitboss marker or the ns_monuploadd_err.pl sink should be treated as probable compromise: patch to 14.1-73.37 / 13.1-64.23 and hunt for web shells.

• 🔒 NetScaler Pre-Auth Command Injection Indicators in CEF Logs — Exploitation (KQL) · unlock with TL Creds
• 🔒 NetScaler WHIPSHOT Web Shell Paths and Masqueraded .ico/.sig Requests (KQL) · unlock with TL Creds
• 🔒 NetScaler C2/Exfil Infrastructure and OpenBullet2 UNC-Path SMB Egress (KQL) · unlock with TL Creds
• 🔒 Citrix NetScaler CVE-2026-88771 Log-Injection Command Injection Attempt (Sigma Primary) · unlock with TL Creds
• 🔒 Citrix NetScaler Web Shell Artifacts in VPN Script and Media Paths (Sigma Primary) · unlock with TL Creds
• 🔒 DNS Lookup to NetScaler Post-Exploitation Domain [indicator] (Sigma Primary) · unlock with TL Creds
• 🔒 NetScaler Web Shell Staging and Masqueraded .ico/.sig Trigger Requests (WHIPSHOT) — Post-Exploitation · unlock with TL Creds
• 🔒 NetScaler Post-Exploitation C2 / Exfiltration Infrastructure (httpworkbench DNS, [indicator], SLAPSHOT tunneling) · unlock with TL Creds

Indicators of compromise for Metasploit 6.5.9 exploit modules

As of 2026-11-06, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5423.

Sample indicators (2 of 13)

• IP address: 138.199.200[.]90
• Domain: instances[.]httpworkbench[.]com

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

How Metasploit 6.5.9 exploit modules works

Public modules lower the barrier for opportunistic exploitation of unpatched appliances.

Rapid7's weekly Metasploit wrap-up published on 2026-11-06 (Metasploit Framework 6.5.9) announces 13 new modules. The highest-risk are exploit modules for network perimeter devices. (1) Citrix NetScaler ADC / Gateway unauthenticated command injection (PR #21962): the Rapid7 post lists the CVE as CVE-2026-88771 in one place and CVE-2026-88773 in the description; vendor, CISA and third-party coverage consistently identify the pre-auth command injection as CVE-2026-88771 (the companion DTLS memory-overflow flaw is CVE-2026-88772). The bug is a log-injection: attacker-controlled input such as a username on an unauthenticated login request is written to a log, and the maintenance script ns_monuploadd_err.pl (per Picus analysis) later builds a shell command from that log content using Perl backticks, so a semicolon in the payload splits the find command and the injected command runs as root. It works on default configurations. Citrix published a bulletin around 2026-09-27/28; CISA added it to KEV on 2026-09-27; watchTowr released a PoC on 2026-09-29 and mass opportunistic exploitation followed. Mandiant/GTIG observed a post-exploitation toolkit with PHP web shells (WHIPSHOT) and a Python tunneler (SLAPSHOT) in government, financial, technology, education and legal sectors; Arctic Wolf counted at least 78 affected organizations. Fixed builds reported by third parties: 14.1-73.37 and 13.1-64.23 or later (13.1.37.279 for FIPS/NDcPP).

(2) Cisco Secure Email Gateway S/MIME/email-parsing SQL injection leading to unauthenticated root RCE (PR #22018): Rapid7 cites CVE-2026-76443; BleepingComputer and others identify the actively exploited zero-day as CVE-2026-76461, with CVE-2026-76440, -76441, -20353 and -76443 patched in the same advisory with no exploitation evidence at the time. The mapping of the module to a specific CVE should be verified against the Cisco advisory (cisco-sa-esa-inj-2bLVGmhX). An attacker sends a crafted email carrying SQL statements through an affected AsyncOS gateway (also Secure Email and Web Manager); no workaround exists.

(3) GitLab CE/EE CI/CD regular-expression compiler integer overflow (CVE-2026-97229, CWE-190, CVSS 10.0; PR #22017): affects 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2; fixed 2026-10-12. Rapid7 reproduced code execution on GitLab CE 19.4.1; the module requires write access to a public project (a malicious .gitlab-ci.yml with UTF-8 characters in a path). Public sources conflict on KEV listing and in-the-wild exploitation; Help Net Security stated none confirmed as of its update.

(4) Other modules: OpenBullet2 >=0.2.5 up to 0.3.2 C# execution-mode RCE (CVE-2026-25856, CVSS 8.8, authenticated per NVD though Rapid7 describes unauthenticated via an auth bypass chain) and NTLMv2 hash disclosure via UNC-path proxy source (CVE-2026-39908); Flowise <=3.0.5 unauthenticated account takeover through forgot-password token disclosure (CVE-2025-58434, CVSS 9.8); SPIP <4.4.23 password-change IDOR (no CVE stated); WordPress Bug Library plugin <2.1.1 unauthenticated PHP file upload (CVE-2024-5450, CVSS 9.1); an authenticated Portainer Docker RCE as root; and a Linux ELF payload-injection persistence module. No threat actor is attributed to the Metasploit release itself. Initial NetScaler CVE-2026-88772 exploitation was suspected state-sponsored espionage, while CVE-2026-88771 exploitation is mass opportunistic activity.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1036 Masquerading

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1610 Deploy Container

Command and Control

T1090 Proxy; T1132.001 Data Encoding: Standard Encoding

Credential Access

T1187 Forced Authentication

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1505.003 Server Software Component: Web Shell; T1554 Compromise Host Software Binary

Resource Development

T1588.005 Obtain Capabilities: Exploits

Remediation for Metasploit 6.5.9 exploit modules

Patches

• Citrix NetScaler 14.1-73.37, 13.1-64.23 or later
• GitLab 19.2.8, 19.3.5, 19.4.2
• Flowise 3.0.6 or later
• Bug Library WordPress plugin 2.1.1 or later
• SPIP 4.4.23 or later

Immediate actions

• Patch Citrix NetScaler ADC/Gateway to 14.1-73.37 / 13.1-64.23 or later (13.1.37.279 for FIPS/NDcPP) and hunt for web shells and unexpected files before and after patching, since patching does not remove an implanted web shell
• Apply the Cisco Secure Email Gateway / Secure Email and Web Manager fixes from advisory cisco-sa-esa-inj-2bLVGmhX; review mail_logs for suspicious SQL statements
• Upgrade self-managed GitLab CE/EE to 19.2.8, 19.3.5 or 19.4.2 or later
• Treat internet-exposed NetScaler and Cisco ESA appliances as potentially compromised if unpatched during September-November 2026

Workarounds

• No workaround exists for the Cisco Secure Email Gateway vulnerabilities
• No workaround published for GitLab CVE-2026-97229; patch immediately

Longer-term hardening

• Restrict management and gateway interfaces and monitor appliance egress for unexpected outbound connections and DNS lookups
• Limit who can create projects and commit CI configuration on self-managed GitLab
• Block outbound SMB/NTLM to untrusted hosts to blunt UNC-path NTLMv2 disclosure
• Track Metasploit module releases to prioritize patching of products that gain public exploits

Affected and fixed versions

• Citrix / Cloud Software Group — NetScaler ADC and NetScaler Gateway
  Vulnerable versions: Default-configuration deployments prior to fixed builds
  Fixed in: 14.1-73.37; 13.1-64.23; 13.1.37.279 (FIPS/NDcPP)
• Cisco — AsyncOS for Secure Email Gateway and Secure Email and Web Manager
  Vulnerable versions: 15.5 and earlier; 16.0; 16.5
  Fixed in: See cisco-sa-esa-inj-2bLVGmhX
• GitLab — GitLab CE/EE
  Vulnerable versions: 19.2 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2
  Fixed in: 19.2.8; 19.3.5; 19.4.2
• OpenBullet — OpenBullet2
  Vulnerable versions: 0.2.5 through 0.3.2
• FlowiseAI — Flowise
  Vulnerable versions: 3.0.5 and earlier
  Fixed in: 3.0.6
• SPIP — SPIP
  Vulnerable versions: before 4.4.23
  Fixed in: 4.4.23
• WordPress plugin — Bug Library
  Vulnerable versions: before 2.1.1
  Fixed in: 2.1.1

Timeline of Metasploit 6.5.9 exploit modules

• 2024-07-13 CVE-2024-5450 (WordPress Bug Library unauthenticated file upload, CVSS 9.1) published in NVD
• 2025-09-12 CVE-2025-58434 (locked-ioc-13 forgot-password token disclosure, CVSS 9.8) published; fixed in locked-ioc-13 3.0.6
• 2026-06-08 CVE-2026-25856 (C# execution RCE) and CVE-2026-39908 (NTLMv2 disclosure) published for OpenBullet2 through 0.3.2
• 2026-09-15 Cisco publishes advisory for Secure Email Gateway SQL-injection-to-root zero-day (reported as CVE-2026-76461) exploited in the wild
• 2026-09-24 GreyNoise detects first NetScaler zero-day exploitation attempt
• 2026-09-27 CISA adds NetScaler CVE-2026-88771 to the KEV catalog; Citrix bulletin follows within a day
• 2026-09-29 watchTowr Labs releases a PoC for CVE-2026-88771 and mass opportunistic exploitation begins
• 2026-10-01 Arctic Wolf and Mandiant publish additional indicators; at least 78 organizations observed affected
• 2026-10-12 GitLab releases 19.4.2, 19.3.5 and 19.2.8 fixing CVE-2026-97229 (CVSS 10.0)
• 2026-11-06 Rapid7 releases Metasploit 6.5.9 with public modules for NetScaler, Cisco ESA, GitLab, OpenBullet2, locked-ioc-13, SPIP, Bug Library and Portainer

Sources cited for Metasploit 6.5.9 exploit modules

• NVD: CVE-2025-58434 (Flowise) NVD (NIST) · Advisory · 2025-09-12
• NVD: CVE-2024-5450 (Bug Library) NVD (NIST) · Advisory · 2024-07-13
• NVD: CVE-2026-25856 (OpenBullet2 RCE) NVD (NIST) · Advisory · 2026-06-08
• VulnCheck: OpenBullet2 NTLMv2 hash disclosure via UNC path proxy source (CVE-2026-39908) vulncheck.com · Advisory · 2026-06-08
• Metasploit Wrapup: Unauth RCE modules in Network Perimeter Devices and much more Rapid7 · Vendor report · 2026-11-06
• Picus Security: CVE-2026-88771 Citrix NetScaler Pre-Auth Command Injection Explained picussecurity.com · Research · 2026-10-14
• SOCRadar: NetScaler C2 and CVE-2026-88771 exploitation kit socradar.io · Research · 2026-10-01
• Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229) Rapid7 · Research · 2026-10-13
• Flowise GitHub Security Advisory GHSA-wgpv-6j63-x5ph GitHub · Code repository · 2025-09-12
• Metasploit Framework repository GitHub · Code repository · 2026-11-06
• Help Net Security: NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771) Help Net Security · News · 2026-10-01
• The Hacker News: Attackers exploit NetScaler flaw (WHIPSHOT / SLAPSHOT toolkit) The Hacker News · News · 2026-09-29
• BleepingComputer: New Cisco Secure Email zero-day exploited to execute commands as root BleepingComputer · News · 2026-09-15
• Help Net Security: GitLab admins urged to patch critical RCE flaw (CVE-2026-97229) Help Net Security · News · 2026-10-13

More in vulnerability

• CVE-2026-113618: Improper Certificate Validation in KAMSOFT ZSIRep CLIENT library
• D-Link DGS-3130 Series Switches: Multiple Unpatched Zero-Days in D-Link Discovery Protocol (DDP) and Firmware (D-Link SAP10523, CVEs Pending)
• Multiple Vulnerabilities in Microsoft Edge (prior to 157.0.4341.42) - 27 Chromium CVEs - HK GovCERT A26-11-10
• Apple September 2026 Security Updates: 273 CVEs incl. actively exploited Screen Sharing auth bypass (CVE-2026-65400) and critical Bluetooth RCE (CVE-2026-65414)
• OpenAI GPT-6 Cyber Identifies 81 Previously Unknown High-Severity Firefox Vulnerabilities (Mozilla MFSA2026-118, Firefox 159)