# CVE-2025-69691: Netgate pfSense CE remote code execution in XMLRPC API

Source: https://junglewise.ai/threats/cve-2025-69691-netgate-pfsense-ce-remote-code-execution-in-xmlrpc-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2025-69691 · Severity: critical · CVSS 9.9 · Published 2026-05-08

Netgate pfSense Community Edition is a widely used open-source firewall and routing software. A vulnerability in its management interface allows an authenticated user to execute arbitrary commands with the highest level of system privileges (root). This could lead to a complete takeover of the firewall, allowing an attacker to intercept network traffic, disable security rules, or access sensitive configuration data.

Technologies: [Pfsense](https://junglewise.ai/threats/technologies/pfsense). Vendors: [Netgate](https://junglewise.ai/threats/vendors/netgate), [Pfsense](https://junglewise.ai/threats/vendors/pfsense).

## Quick answers

**Is CVE-2025-69691 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-69691 being exploited in the wild.

**How severe is CVE-2025-69691?** Critical severity, with a CVSS score of 9.9, published 8 May 2026.

**Which products and versions are affected?** Netgate pfSense Community Edition (CE) 2.8.0.

**Is there a fix for CVE-2025-69691?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-69691 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-69691?** Check whether you run Netgate pfSense Community Edition (CE) or Pfsense at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The pfSense CE 2.8.0 XMLRPC API exposes a method named 'pfsense.exec_php' that executes arbitrary PHP code without validation or sandboxing. An attacker with valid credentials (even low-privileged ones, according to the CVSS vector provided by CISA-ADP) can send a crafted XMLRPC request to the /xmlrpc.php endpoint to execute system commands as the root user. While the vendor disputes the severity by stating this is intended functionality for administrators, the lack of restrictions on the method allows for trivial remote code execution. No patch is currently available as the vendor considers this expected behavior.

## Affected products

- Netgate pfSense Community Edition (CE) 2.8.0

## Timeline

- 2025-11: other: Vulnerability discovered
- 2025-12-02: disclosed: Initial report to Netgate
- 2026-01-28: other: CVE assigned by MITRE
- 2026-02-16: advisory: Public disclosure by researcher
- 2026-05-08: other: NVD publication date

## References

- [https://seclists.org/fulldisclosure/2026/Feb/16](https://seclists.org/fulldisclosure/2026/Feb/16)
- [https://www.linkedin.com/in/nelson-adhepeau/](https://www.linkedin.com/in/nelson-adhepeau/)

## Related threats

- [Netgate pfSense CE stored cross-site scripting in firewall rules](https://junglewise.ai/threats/cve-2026-111232-netgate-pfsense-ce-2-3-0-through-2-9-0-contains-a-stored-cross)
- [Netgate pfSense CE authorization bypass in config restore](https://junglewise.ai/threats/cve-2026-111231-netgate-pfsense-ce-through-2-9-0-contains-an-authorization)
- [Netgate pfSense CE local file read via Dynamic DNS](https://junglewise.ai/threats/cve-2026-111230-netgate-pfsense-ce-through-2-9-0-contains-a-local-file-read)
- [Netgate pfSense CE CRLF injection in Unbound configuration](https://junglewise.ai/threats/cve-2026-111228-netgate-pfsense-ce-from-2-7-1-through-2-9-0-contains-a-crlf)
- [Netgate pfSense CE CRLF injection in DNS Resolver ACLs](https://junglewise.ai/threats/cve-2026-111227-netgate-pfsense-ce-through-2-9-0-contains-a-crlf-injection)