CVE-2026-109681 Rapid7 CVE debrief

Who should care

Defenders responsible for Metasploit Framework deployments, particularly those using FTP services, should assess exposure and prioritize patching to prevent potential SSRF attacks.

Why it matters

CVE-2026-109681 is a medium-severity vulnerability in Metasploit Framework's FTP client that allows for SSRF attacks. Defenders should prioritize patching and monitoring to prevent potential exploitation.

• Potential SSRF attacks targeting FTP services
• Need to verify and apply the patch to prevent exploitation
• Importance of inventory management to identify affected versions
• Monitoring for potential SSRF attacks

Technical summary

The Metasploit Framework's FTP client trusts the server's PASV response IP:port without validation, allowing a rogue FTP server to specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host. This vulnerability allows for SSRF attacks, and defenders should prioritize verifying and applying the patch, reviewing and updating inventory, and monitoring for potential SSRF attacks. The affected product context is Metasploit Framework, and the defensive impact is potential SSRF attacks targeting FTP services.

Defensive priority

Defenders should prioritize verifying and applying the patch, as the vulnerability allows for SSRF attacks.

Recommended defensive actions

• Verify and apply the patch for Metasploit Framework version 6.5.7 or later
• Review and update inventory to ensure affected versions are identified and remediated
• Monitor for potential SSRF attacks targeting FTP services
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on potential exploitation or impact. Defenders should verify the patch for Metasploit Framework version 6.5.7 or later and review inventory to ensure affected versions are identified and remediated. The source item and CVE Program record provide source-provided CVE metadata.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.