CVE-2025-69691: Pfsense

Critical severity, CVSS 9.9. EPSS: 0.7% chance of exploitation in the next 30 days.

Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code.

Affected products

• Pfsense Pfsense: version 2.8.0 only

Published 2026-05-08. Last modified 2026-06-17.