Two of the most attacked kinds of network edge device just got easier to break into. Rapid7's weekly Metasploit release, written up by Jack Heysel, adds ready-made exploit modules for Citrix NetScaler and Cisco Secure Email Gateway that run code on the device without any login.
Metasploit is a penetration-testing framework, and its modules exist so defenders and red teams can prove a box is vulnerable. But a free, maintained module also removes most of the skill needed to attack the same box, which is why a Metasploit release for an already exploited bug tends to mark the point where patching stops being optional.
The Citrix bug was already being exploited
The NetScaler module targets CVE-2026-88771, an unauthenticated command injection that the module's title ties to NetScaler's login log. Rapid7 notes it was exploited in the wild before Citrix disclosed it, and CISA added it to its Known Exploited Vulnerabilities catalog on 27 September 2026. It carries a CVSS score of 9.5. The module, contributed by Rapid7's Stephen Fewer (sfewer-r7) and credited to CERT-EU, Scyrix LLC and watchTowr as well, lands after weeks of real-world abuse we have tracked, including intrusions that began three days before disclosure. The module's metadata also references a second Citrix identifier, CVE-2026-88773, from the same patch set.
Cisco's email gateway falls to SQL injection
The second perimeter module, also by Fewer, exploits a SQL injection in Cisco Secure Email Gateway to gain unauthenticated remote code execution as root. Rapid7 is candid that the mapping is uncertain: Cisco's advisories are vague, and the team says it has reason to believe the flaw is CVE-2026-76443, which is rated 9.8. That is not the same CVE as the gateway SQL injection CISA flagged as exploited in September, so treat this as an additional reason to be current, not a confirmation of attacks.
GitLab, Flowise and OpenBullet2 join the list
The release ships 13 new modules in total. Among them:
- An authenticated GitLab CI/CD exploit for CVE-2026-97229, the regular-expression integer overflow that Rapid7 first proved exploitable in October. It needs credentials with write access to a public project and runs commands as the git user.
- A Flowise account-takeover module for CVE-2025-58434. Flowise 3.0.5 and earlier return a valid password-reset token directly in the API response, so anyone who knows an account's email address can reset its password.
- Two OpenBullet2 modules from version 0.2.5 onward: unauthenticated code execution (CVE-2026-25856) and an NTLMv2 hash leak on Windows via a malicious UNC path (CVE-2026-39908).
- A SPIP password-change flaw fixed in 4.4.23, which has no CVE yet, and an older WordPress Bug Library plugin upload bug (CVE-2024-5450).
Patch NetScaler and the Cisco gateway first
For NetScaler ADC and Gateway, the NVD record lists 14.1-73.37 and 13.1-64.23 as the first fixed builds; Citrix's bulletin has the full matrix, including FIPS editions. For Cisco Secure Email Gateway, apply the fixes in Cisco's current advisories, and because the CVE mapping is unconfirmed, do not assume a box is safe just because one specific CVE is addressed. Flowise users should be on a release newer than 3.0.5, and SPIP sites on 4.4.23 or later.
Every one of these modules can now be pointed at an exposed appliance by someone who has never read the advisory. The window in which an unpatched gateway was only a target for skilled crews has closed.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.