CVE-2026-62878 is a stack-based buffer overflow in Microsoft Windows DNS Server. NUL-first DNS labels collide in one NTree cache bucket until a fixed-size stack array is exceeded, corrupting the stack cookie and terminating dns.exe. An unauthenticated remote attacker can exploit this behavior to cause a denial of service. This module performs the following steps: 1. Confirms that the target recursively resolves random names below a public domain and records baseline UDP and TCP availability. 2. Sends a DNS query containing a NUL-first label and verifies that the target returns a non-authoritative NXDOMAIN or NODATA response. 3. Sends 600 unique ASCII-safe NUL-first names so distinct negative-cache nodes accumulate in the same NTree bucket. 4. Waits briefly, then probes every DNS transport that worked before the trigger and records whether the DNS service became unavailable.

This module exploits an improper authentication vulnerability in the JFrog Access service used by JFrog Artifactory. In the vulnerable default configuration, Access trusts an additional cluster join key derived from an empty value. An unauthenticated remote attacker can use that known signing material to forge a valid HS256 cluster-join JWT and obtain a service identity without prior credentials. The forged service identity can then request an administrator-scoped access token. Successful authorization to an admin-only Artifactory endpoint demonstrates that the authentication boundary was bypassed. Important exploitation steps: Generate a fresh HS256 cluster-join JWT using the blank-key identifier and a generated service identifier. Submit the JWT to the unauthenticated Access registry-join endpoint and receive a service token. Exchange the service token for a non-refreshable administrator token with applied-permissions/admin scope, wildcard audience, and expires_in=0. Request the protected Artifactory system configuration endpoint with the administrator token. Confirm the vulnerability when the protected endpoint returns HTTP 200. Once this module validates the token, it is stored as a Core Impact HTTP identity so that it can be reused.

This module exploits CVE-2026-88772, a memory overflow vulnerability present in the DTLS parser of the NSPPE executable of Citrix NetScaler ADC and Gateway to cause a Denial of Service. The module will exploit the vulnerability by connecting to the UDP socket of the Gateway, establish a proper DTLS state for the target to accept later handshake traffic and finally crash the NSPPE executable by sending 120 handshake records that will make the DTLS parser of the executable mishandle the reassembly/state and lead to a crash, causing a warm restart. The module will check if the denial of service was successful after 10 seconds.

CVE-2026-9198 is an unauthenticated remote code execution vulnerability chain in Langflow OSS when AUTO_LOGIN is enabled. An unauthenticated network attacker can exploit CVE-2026-9103 to obtain a superuser access token from /api/v1/auto_login without credentials, then leverage CVE-2026-8481 in /api/v1/validate/code to execute user-controlled Python through exec(). By chaining these vulnerabilities, CVE-2026-9198 allows arbitrary command execution on the Langflow server. Langflow OSS versions 1.0.0 through 1.10.0, inclusive, are vulnerable. The vulnerability is fixed in version 1.10.1. The module performs the following steps: 1. Determines whether the Langflow service uses plain HTTP or HTTPS. 2. Requests an access token without credentials from /api/v1/auto_login. 3. Queries /api/v1/users/whoami and requires the returned user to have is_superuser set to true, confirming CVE-2026-9103. 4. Queries the superuser-protected /api/v1/users/?limit=1 endpoint and requires an HTTP 200 response as a second privilege check. 5. Submits a crafted Python function decorator to /api/v1/validate/code. The decorator executes immediately through exec(), and the module recovers command output from function.errors. 6. Executes the whoami command, recovers its output, and identifies the operating system reported by the vulnerable Langflow Python process, confirming CVE-2026-8481 and the complete CVE-2026-9198 chain. 7. When DEPLOY OSCI AGENT is enabled, the module commits a non-blind OSCI agent associated with CVE-2026-9198 that reuses the same Langflow primitive to relaunch commands later without copying a Core Impact executable agent into the target. 8. Stores the Langflow connection parameters required to request a fresh AUTO_LOGIN token whenever the OSCI agent executes a command. 9. Relaunches commands through /api/v1/validate/code and returns their standard output and exit status to the Impact console. 10. When DEPLOY NETWORK AGENT is enabled, the module stages an Impact payload from the embedded web server and launches it through the vulnerable Langflow service. 11. Waits for the native agent connection, associates a successful deployment with CVE-2026-9198, and performs the cleanup required by the selected deployment method. The executed commands and any deployed agent will run with the privileges of the Langflow service account.

This module sends a crafted HTTP/1.1 request over TLS to a service backed by the Windows HTTP Protocol Stack driver, HTTP.sys. The request contains a large number of compact headers. The exploit uses LINE mode, sending each complete HTTP line in a separate TLS application-data write to align with the ZDI trigger mechanics and accumulate HTTP.sys buffer references.

This module exploits CVE-2026-4480, an unauthenticated remote command injection vulnerability in the Samba printing subsystem. Samba passes the client-controlled print-job description to the configured "print command" through the %J substitution without escaping shell metacharacters, allowing commands to be executed remotely. The vulnerable application is a Samba print server. Affected versions are Samba 4.22.9 and earlier, 4.23.0 through 4.23.7, and 4.24.0 through 4.24.2. Exploitation requires an accessible printer share whose "print command" contains %J. This module performs the following steps: Connects to the target SMB service and binds to the spoolss named pipe using MS-RPRN. Enumerates advertised printer shares and automatically selects the first print queue, or uses the printer name supplied in Manual mode. Generates the commands required to transfer and launch a Linux x86-64 Core Impact agent. Encodes each command in Base64 and places the decoding pipeline in the client-controlled print-job description that Samba expands as %J. Submits a non-empty RAW print job and completes it to trigger the vulnerable server-side "print command". Executes the generated commands in the Samba print-processing security context and deploys the Core Impact agent.

This module performs profile-driven HTTP/2 HPACK bomb denial-of-service attacks against vulnerable servers. The module selects the requested profile and applies its default attack parameters unless PORT, CONNECTIONS or STREAMS are overridden. It verifies target reachability and, when required, records a pre-attack TCP or TLS latency baseline. It then establishes HTTP/2 sessions by negotiating h2, sending the client preface, and completing the initial SETTINGS exchange. After setup, it sends profile-specific HPACK bomb payloads through HEADERS and CONTINUATION frames across multiple streams. These payloads force the server to expand small compressed header blocks into much larger in-memory header state or repeated header reconstruction work. The attacked streams are held open for a profile-specific interval, optionally using WINDOW_UPDATE drips to keep server-side state active. Finally, the module determines success from post-attack liveness, latency degradation, or recovery behavior, depending on the selected profile. Blank parameters inherit the selected profile defaults. Most profiles require TLS plus ALPN h2 support in the runtime SSL stack. Pingora can be used over cleartext h2c by disabling USE TLS.

CVE-2026-9082 is a SQL injection vulnerability in Drupal Core when Drupal uses PostgreSQL. The vulnerable PostgreSQL Entity Query condition handling can place attacker-controlled array keys into PDO placeholder names, allowing raw SQL to reach PostgreSQL from anonymous HTTP entry points that build entity queries. In exposed configurations, this can lead to arbitrary SQL execution, data disclosure, privilege escalation, and, when the PostgreSQL role has sufficient privileges, remote code execution. The affected Drupal Core versions are 8.9.0 through 10.4.9, 10.5.0 through 10.5.9, 10.6.0 through 10.6.8, 11.0.0 through 11.1.9, 11.2.0 through 11.2.11, and 11.3.0 through 11.3.9, only for sites using PostgreSQL. This module targets the JSON:API filter entry point. It automatically discovers a usable JSON:API resource and filter field, validates the SQL injection by leaking PostgreSQL context, and commits CVE-2026-9082 when the primitive is confirmed. If the PostgreSQL role is superuser, the module writes an Impact agent and an embedded PostgreSQL preload library through large objects, updates PostgreSQL preload settings, reloads the configuration, and launches the agent from a fresh PostgreSQL backend. If the role is not superuser, the module collects bounded PostgreSQL and Drupal evidence, then finishes gracefully after reporting that agent deployment is not possible.

NGINX Plus and NGINX Open Source have a heap overflow vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the "rewrite" directive with a query string is followed (in the same location) by the "if" or "set" directive with an unnamed Perl-Compatible Regular Expression (PCRE) capture. An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. This module will first check if the endpoint given in the ENDPOINT parameter is present. If no parameter is provided, the module will use "/api" as the default value. Then it will send a HTTP request to the endpoint to cause the DoS and try to determine if the attack was successful.

This module authenticates to the Zabbix JSON-RPC API with the supplied account, discovers the remote API version, and attempts SQLi-based administrator session extraction through CUser::addRelatedObjects(), reachable from the user.get method. CVE-2024-42327 does not require an administrator account. A non-admin user with the default User role, or any role with API access, can reach the vulnerable user.get API path. The affected Zabbix application versions are 6.0.x before 6.0.32rc1, 6.4.x before 6.4.17rc1, and 7.0.x before 7.0.1rc1. When SQLi session extraction succeeds, the module uses the extracted session to check whether Zabbix system.run is enabled and installs a Core Impact agent only if system.run is enabled. The module performs the following steps: 1. Discovers a reachable Zabbix JSON-RPC API endpoint and reads the remote version. 2. Authenticates with the supplied Zabbix credentials. 3. Checks whether the detected version is within the publicly affected CVE-2024-42327 ranges. 4. Attempts to extract an administrator session through SQLi-based timing checks. 5. Commits CVE-2024-42327 when administrator session extraction succeeds. 6. Uses the extracted session to resolve the target host and interface context. 7. Checks whether Zabbix system.run is enabled on the target Zabbix agent. 8. installs a Core Impact agent through system.run only when that capability is available. 9. Removes temporary Zabbix items created during probing or deployment.