Is CVE-2025-69690 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-69690 being exploited in the wild.

How severe is CVE-2025-69690?

Critical severity, with a CVSS score of 9.1, published 8 May 2026.

Is there a fix for CVE-2025-69690?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-69690 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-69690?

Check whether you run Netgate Pfsense Ce or Pfsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-69690: Netgate pfSense CE PHP deserialization in backup restore

CVE-2025-69690 · Severity: critical · CVSS 9.1 · Published 2026-05-08

Netgate pfSense CE is a popular open-source firewall and routing software used to secure corporate and home networks. A vulnerability in the configuration restore process allows an administrator to execute arbitrary commands with full system privileges by uploading a specially crafted backup file. While this requires administrative access, it could be used by a malicious insider or an attacker who has already compromised an admin account to gain permanent, deep-level control over the firewall hardware.

Technologies: Netgate Pfsense Ce, Pfsense. Vendors: Netgate, Pfsense.

Quick answers

Is CVE-2025-69690 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-69690 being exploited in the wild.
How severe is CVE-2025-69690?: Critical severity, with a CVSS score of 9.1, published 8 May 2026.
Which products and versions are affected?: Netgate Pfsense Ce 2.7.2.
Is there a fix for CVE-2025-69690?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-69690 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-69690?: Check whether you run Netgate Pfsense Ce or Pfsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authenticated remote code execution vulnerability exists in pfSense CE 2.7.2 due to the unsafe use of the PHP unserialize() function within the configuration restore mechanism. The 'pfsense_module_installer' class handles user-controlled data from backup files without proper class whitelisting or input validation. An attacker with administrative privileges can craft a backup file containing a serialized PHP object with a malicious 'post_reboot_commands' property. When the restore operation is triggered, the system unserializes the object and executes the embedded commands via mwexec() with root privileges. The vendor has disputed the vulnerability, stating that administrators are intentionally permitted to execute PHP code, and no patch is currently planned.

Affected products

Netgate pfSense CE 2.7.2

Timeline

2025-11: other: Vulnerability discovered
2025-12-02: disclosed: Initial report to Netgate
2026-01-28: other: CVE assigned by MITRE
2026-02-16: advisory: Public disclosure via Full Disclosure mailing list
2026-05-08: other: NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.