CVE-2025-69691 — Vulnerability intelligence

pfsense — pfsense

Published: 2026-05-08T00:00:00.000Z

CVSS

9.9

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code.

Sources

• CVE-2025-69691
• Exploit, Mailing List, Third Party Advisory
• Not Applicable
• CVE-2025-69691