Metasploit Releases 7 New Exploit Modules covering FreePBX, Cacti and SmarterMail

Metasploit's latest release introduces seven new modules that enable unauthenticated and chained attacks against widely used infrastructure: FreePBX (authentication bypass CVE-2025-66039 chained to SQLi CVE-2025-61675 or file upload CVE-2025-61678 to achieve RCE or admin creation), Cacti (unauthenticated RCE via CVE-2025-24367), and SmarterMail (unauthenticated file upload/path traversal CVE-2025-52691), along with persistence modules for Burp Suite and consolidated SSH key persistence; organizations should prioritize patching, hardening exposed services, and auditing for signs of compromise.