Metasploit Framework released an update improving SMB NTLM relay server functionality.
The update enhances compatibility with clients like Linux's smbclient by altering relaying strategy for single targets.
RubySMB client behavior was updated to mimic Windows' "net use" for multi-target relaying.
Three new exploit modules were added: ESC/POS Printer Command Injector (CVE-2026-23767), Eclipse Che machine-exec Unauthenticated RCE (CVE-2025-12548), and Barracuda ESG TAR Filename Command Injection (CVE-2023-2868).
The ESC/POS module targets unauthenticated command injection in Epson-compatible printers.
The Eclipse Che module exploits an unauthenticated RCE via WebSocket on port 3333 in Red Hat OpenShift DevSpaces.
The Barracuda ESG module exploits command injection through unsanitized TAR filenames.
Five bugs were fixed, including issues with environment variable expansion, authentication relay compatibility, logging behavior, Mach-O binary identification, VBS payload generation, and msfconsole command parsing.
Documentation is available at docs.metasploit.com.
Updates can be obtained via msfupdate, git, or installers.

This week's Metasploit Framework update introduces significant improvements to its NTLM relaying functionality, particularly for the SMB NTLM relay server. Previously, the relaying process required clients to handle SMB's STATUSNETWORKSESSIONEXPIRED error code, limiting compatibility to specific clients like Windows' "net use." The update now allows immediate forwarding of Net-NTLM messages when a single target is specified, broadening compatibility to include Linux's smbclient and other clients. Additionally, the RubySMB client has been updated to mimic "net use" behavior, enabling successful relaying to multiple targets.
The release also includes three new exploit modules. The first targets CVE-2026-23767, an unauthenticated ESC/POS command injection vulnerability in Epson-compatible printers. The second exploits CVE-2025-12548, an unauthenticated RCE in Eclipse Che's machine-exec service, affecting Red Hat OpenShift DevSpaces. The third addresses CVE-2023-2868, a command injection flaw in Barracuda Email Security Gateway appliances via TAR filename manipulation. Bug fixes include improvements to environment variable handling in post modules, authentication relay compatibility, logging behavior, Mach-O binary identification, VBS payload generation, and msfconsole command parsing. Documentation and installation options remain consistent with previous releases.

The strongest version of this narrative highlights Metasploit's ongoing evolution as a critical tool for security professionals, emphasizing its adaptability to new vulnerabilities and client compatibility. The update demonstrates a clear commitment to broadening the framework's utility while addressing practical limitations in real-world scenarios. The inclusion of high-profile CVEs (e.g., Barracuda ESG, Eclipse Che) underscores its relevance in contemporary threat landscapes, particularly in enterprise environments like Red Hat OpenShift.
Pattern-wise, the content avoids overt manipulation, focusing on technical details without emotional appeals or distortion. However, the framing implicitly reinforces the paradigm of offensive security as a necessary counterbalance to defensive measures—a perspective that, while widely accepted, merits scrutiny. The assumption that "better relaying" is inherently positive overlooks potential misuse, though the article stops short of advocating for unethical applications. Historically, this echoes the dual-use dilemma in cybersecurity tools, where offensive capabilities are developed under the guise of defensive research.
For human agency, the implications are dual-edged: security teams gain stronger tools to test and secure systems, but attackers may also leverage these updates. The second-order consequences include a potential arms race in exploit development, where defenders must continuously adapt. Missing perspectives might include the ethical boundaries of publishing such tools and the long-term impact on trust in networked systems.
Bridge questions: How should the security community balance transparency in tool development with the risk of enabling malicious actors? What safeguards could mitigate the dual-use nature of frameworks like Metasploit? Would the absence of such tools lead to more or fewer vulnerabilities being discovered and patched?
Counterstrike scan: If this were part of a coordinated influence campaign, the playbook might involve exaggerating the tool's capabilities to incite fear or justify restrictive cybersecurity policies. However, the content aligns with Metasploit's established role as a legitimate security resource, with no signs of manipulation. The focus remains technical and pragmatic, devoid of inflammatory rhetoric or hidden agendas.
Patterns detected: none