This module exploits CVE-2026-75650, a critical unauthenticated template injection vulnerability in Magento Open Source and Adobe Commerce known as StyleSmuggler. Improper neutralization of template-engine elements allows a remote attacker to execute arbitrary code through the Magento storefront. The exploit performs the following actions: Sends a crafted request to the Payflow transparent-response endpoint to create a Magento error report containing a PHP command runner. Extracts the generated report identifier and resolves its location. A configured REPORT DIRECTORY override is tried first; otherwise, the module tests paths relative to the Magento front controller. Creates an unauthenticated guest cart and assigns a guest email address. Stores the StyleSmuggler Preview block payload in the guest billing address. Triggers the failed-payment GraphQL path with a crafted styles object graph that includes the poisoned report. Confirms operating-system command execution with a harmless marker and deploys the selected Impact agent. By default, the module commits an interactive OSCI agent that replays the complete StyleSmuggler chain for every command and returns standard output. A Linux x86-64 Network Agent can be deployed as an alternative through the standard download-and-execute flow, which tries curl, wget, and BusyBox wget in that order. Commands and agents run with the privileges of the Magento web-server process. No Magento credentials are required. The module supports HTTP and HTTPS services, including IPv6 targets. Adobe lists Adobe Commerce 2.4.4-2026-aug through 2.4.9-2026-aug and earlier releases in those version lines, Adobe Commerce B2B 1.3.3-2026-aug through 1.5.3-2026-aug and earlier releases in those version lines, and Magento Open Source 2.4.6-2026-aug through 2.4.9-2026-aug and earlier releases in those version lines as affected.

This module exploits CVE-2026-75650, a critical unauthenticated template injection vulnerability in Magento Open Source and Adobe Commerce known as StyleSmuggler. Improper neutralization of template-engine elements allows a remote attacker to execute arbitrary code through the Magento storefront. The exploit performs the following actions: Sends a crafted request to the Payflow transparent-response endpoint to create a Magento error report containing a PHP command runner. Extracts the generated report identifier and resolves its location. A configured REPORT DIRECTORY override is tried first; otherwise, the module tests paths relative to the Magento front controller. Creates an unauthenticated guest cart and assigns a guest email address. Stores the StyleSmuggler Preview block payload in the guest billing address. Triggers the failed-payment GraphQL path with a crafted styles object graph that includes the poisoned report. Confirms operating-system command execution with a harmless marker and deploys the selected Impact agent. By default, the module commits an interactive OSCI agent that replays the complete StyleSmuggler chain for every command and returns standard output. A Linux x86-64 Network Agent can be deployed as an alternative through the standard download-and-execute flow, which tries curl, wget, and BusyBox wget in that order. Commands and agents run with the privileges of the Magento web-server process. No Magento credentials are required. The target webpage supplies the HTTP or HTTPS scheme, host, port, and Magento installation path. Adobe lists Adobe Commerce 2.4.4-2026-aug through 2.4.9-2026-aug and earlier releases in those version lines, Adobe Commerce B2B 1.3.3-2026-aug through 1.5.3-2026-aug and earlier releases in those version lines, and Magento Open Source 2.4.6-2026-aug through 2.4.9-2026-aug and earlier releases in those version lines as affected.

This module exploits CVE-2026-109618, a use-after-free vulnerability in PHP's multipart upload-progress/session handling. When PHP reaches memory_limit during specially structured multipart processing, an abnormal bailout can leave session-related Zend objects dangling in a persistent Apache worker. A later request handled by that same worker can reuse the freed memory, turning the stale references into memory disclosure and, ultimately, code execution, to deploy an OSCI agent. The module first occupies 255 of Apache's 256 prefork workers, forcing every stage onto the same remaining process. Its A1 request triggers the faulty out-of-memory cleanup, and B1 reclaims the stale session identifier with a forged string. Reading that string beyond its legitimate bounds leaks heap and libphp pointers, allowing the module to calculate the heap base, libphp base, and address of PHP's internal zif_system function despite ASLR. A second out-of-memory request, A2, creates another dangling session reference. B2 then sprays the corresponding allocation class with forged zend_reference, zend_array, zend_execute_data, and zend_string objects. The fake array's destructor points to zif_system, while its fabricated call frame supplies the user's command as the function argument. When PHP destroys the reclaimed object, it follows the forged destructor and invokes system(command). The command is stored in the unused tail of a 384-byte heap carrier; after the required structures and NUL terminator, this provides a validated maximum of 231 command bytes. The chain is layout-specific and was calibrated for the controlled PHP 8.4.26 Apache-prefork environment.

This module exploits CVE-2026-109618, a use-after-free vulnerability in PHP's multipart upload-progress/session handling. When PHP reaches memory_limit during specially structured multipart processing, an abnormal bailout can leave session-related Zend objects dangling in a persistent Apache worker. A later request handled by that same worker can reuse the freed memory, turning the stale references into memory disclosure and, ultimately, code execution, to deploy an OSCI agent. The module first occupies 255 of Apache's 256 prefork workers, forcing every stage onto the same remaining process. Its A1 request triggers the faulty out-of-memory cleanup, and B1 reclaims the stale session identifier with a forged string. Reading that string beyond its legitimate bounds leaks heap and libphp pointers, allowing the module to calculate the heap base, libphp base, and address of PHP's internal zif_system function despite ASLR. A second out-of-memory request, A2, creates another dangling session reference. B2 then sprays the corresponding allocation class with forged zend_reference, zend_array, zend_execute_data, and zend_string objects. The fake array's destructor points to zif_system, while its fabricated call frame supplies the user's command as the function argument. When PHP destroys the reclaimed object, it follows the forged destructor and invokes system(command). The command is stored in the unused tail of a 384-byte heap carrier; after the required structures and NUL terminator, this provides a validated maximum of 231 command bytes. The chain is layout-specific and was calibrated for the controlled PHP 8.4.26 Apache-prefork environment.

CVE-2025-24813 is a path-equivalence vulnerability in the Apache Tomcat DefaultServlet partial PUT implementation that can lead to remote code execution under specific server-side conditions. The vulnerable implementation derives a temporary filename from the attacker-controlled request path by replacing path separators with dots. A crafted partial PUT path can therefore collide with the filename of a persisted session. When Tomcat restores that attacker-controlled session, unsafe Java deserialization can lead to remote command execution. Depending on the server configuration, the same underlying issue can also disclose security-sensitive uploaded files or allow attacker-controlled content to be injected into them; this module exercises the remote-code-execution condition. The module performs the following vulnerability-specific operations: Constructs a fresh version-specific Commons Collections serialized object containing the command to execute. Sends the object in a partial PUT request to a crafted path whose temporary filename collides with the FileStore session filename. Requests the selected session-aware route with the corresponding JSESSIONID, causing PersistentManager and FileStore to restore and deserialize the planted session. Retrieves a randomized command proof before confirming remote code execution and creating the OSCI agent. Successful exploitation creates an OSCI agent with the operating-system privileges of the Tomcat service account.

CVE-2025-24813 is a path-equivalence vulnerability in the Apache Tomcat DefaultServlet partial PUT implementation that can lead to remote code execution under specific server-side conditions. The vulnerable implementation derives a temporary filename from the attacker-controlled request path by replacing path separators with dots. A crafted partial PUT path can therefore collide with the filename of a persisted session. When Tomcat restores that attacker-controlled session, unsafe Java deserialization can lead to remote command execution. Depending on the server configuration, the same underlying issue can also disclose security-sensitive uploaded files or allow attacker-controlled content to be injected into them; this module exercises the remote-code-execution condition. The module performs the following vulnerability-specific operations: Constructs a fresh version-specific Commons Collections serialized object containing the command to execute. Sends the object in a partial PUT request to a crafted path whose temporary filename collides with the FileStore session filename. Requests the selected session-aware route with the corresponding JSESSIONID, causing PersistentManager and FileStore to restore and deserialize the planted session. Retrieves a randomized command proof before confirming remote code execution and creating the OSCI agent. Successful exploitation creates an OSCI agent with the operating-system privileges of the Tomcat service account.

This module remotely exploits CVE-2026-87902, a path traversal vulnerability in WordPress Core's page-template resolution, to deploy an OSCI agent without WordPress credentials. The vulnerability is used to include PEAR's pearcmd.php and create a temporary PHP command loader. The module includes that loader through the vulnerable template path, captures operating-system command output, and removes the loader after every command. The OSCI agent is deployed by default, does not copy a native executable to the target, and does not depend on the target processor architecture. Commands run with the privileges of the PHP web server process. A classic network agent can be enabled through the hidden framework deployment properties. Each command uses two HTTP requests, is limited to 65535 UTF-8 bytes, and returns at most 1 MiB of combined standard output and standard error.

This module exploits CVE-2026-87902, a path traversal vulnerability in WordPress Core's page-template resolution, to deploy an OSCI agent without WordPress credentials. The vulnerability is used to include PEAR's pearcmd.php and create a temporary PHP command loader. The module includes that loader through the vulnerable template path, captures operating-system command output, and removes the loader after every command. The OSCI agent is deployed by default, does not copy a native executable to the target, and does not depend on the target processor architecture. Commands run with the privileges of the PHP web server process. A classic network agent can be enabled through the hidden framework deployment properties. Each command uses two HTTP requests, is limited to 65535 UTF-8 bytes, and returns at most 1 MiB of combined standard output and standard error.

This module exploits CVE-2026-59310, a directory traversal vulnerability in the Syslog server component of VMware vCenter Server to deploy an Core Impact OSCI agent. The module will use the vulnerability to create a log file inside the /opt/vmware/share/htdocs/configurev2/ directory and then verify the result via a HTTP GET request to the /configurev2 endpoint via the 5480 port with a random filename terminated in the "-syslog.log" string. Then, the module will try to erase the created log file by using the vulnerability again to create a cron file inside the /etc/cron.d/ directory. The cron job will autodelete itself. If the target is vulnerable, the module will deploy an Core Impact OSCI agent with capabilities to execute commands as root. Due to the way the vulnerability is exploited, no command output is possible, so Core Impact OSCI agent terminal commands will be marked as blind.

This module performs the following steps: 1. Checks whether the Drupal i18n_sso token endpoint is present. 2. Submits a random token as a negative control and verifies that it is rejected. 3. Sends unauthenticated wildcard-token requests to the Drupal i18n_sso login endpoint. 4. Repeats the wildcard request according to MAX ATTEMPTS and POLL INTERVAL until a matching active token is found. 5. Confirms the authentication bypass only when Drupal reports success and returns a valid Drupal session cookie. 6. Uses the acquired session to identify the authenticated Drupal account. 7. Stores the session cookie as an Impact identity and records CVE-2026-16639 on the target.