CVE-2025-69691CWE-284CWE-915broken-access-control

CVE-2025-69691

Critical · published May 8, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
51.7
In the wild
Unconfirmed
What it is

Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00677 · 51.7th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
Published
2026-05-08T11:16Z
Affected products (1)
ProductVersionsFixed in
pfsense/pfsenseall versions—
References (3)
https://seclists.org/fulldisclosure/2026/Feb/16 · [email protected]https://www.linkedin.com/in/nelson-adhepeau/ · [email protected]https://seclists.org/fulldisclosure/2026/Feb/16 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 08 MAY 00:00Z
    Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php
    cvelistv5