CVE-2025-69690: Pfsense

Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days.

Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code.

Affected products

• Pfsense Pfsense: version 2.7.2 only

Published 2026-05-08. Last modified 2026-06-17.