I have been learning about metasploit and it is a framework of exploit and payloads. So what if the system is updated, does that mean those exploits won't work anymore? Can you explain more about it?
Metasploit exploits different classes of vulnerabilities such as buffer overflows (stack, heap etc), default credentials, human weaknesses (such as clicking or downloading a binary executable etc), or interacting with a privileged interface that is not properly protected through authentication. Not every class of vulnerabilities can be mitigated through updates.
However, keep this in mind that updates do provide a real defense against a lot of remotely exploitable vulnerabilities and must be applied as soon as released by the vendor (especially in case of personal systems).
Metasploit's exploits are basically known public exploits, they have CVEs. But when you say system is updated, you need to understand that it's not as simple as that!
I mean, take this for example. You have updated and patched your windows system and there are no metasploit exploits that are available in the framework that can exploit the operating system. But then you decide to go browsing on your local browser and opened a site that used flashplayer and the version of that flash player has a DOS vulnerability (Most of them do). Flashplayer works on a separate port exposed to the network, which then can be exploited using the metasploit exploit modules. Similar examples can be given for other software.
So it's not just about updating your operating system, but also all the software and processes that are on your system.
From your question i also get a feeling what you want to ask is are any non publicly available exploits available in the metasploit framework? Well, the answer is no. In fact there are many CVEs that do not have a metasploit's exploit module.
Hope this helps!
Metasploit is not "magic" which just makes things (exploitation) work. Metasploit is a tool that facilitates many activities in the area of vulnerability scanning and penetration testing, also in the area of exploitation. An "exploit" can only exist if also a vulnerability exists. Keep in mind that (1) by far not all vulnerabilities can be exploited and (2) if it is exploitable this doesn't mean someone has written exploit code or (3) if someone has succeeded in writing an exploit that someone might not have made the exploit code public. The "exploit" can be many things, it can by a piece of C coding compiled into an executable, a python program and also a metasploit exploit module. The advantage of metasploit is simply that it makes many things easier you need to do manually otherwise. Think of it like a power shovel compared to a shovel. Now if a vulnerability is removed because the software vendor has provided a fix then obviously the exploit doesn't work anymore (that's the whole purpose of patching a vulnerability) regardless how you launch it.