CVE-2025-69691: pfsense Improper Access Control
CVSS: 9.9v3.1CriticalAnalyzed
Published 08-05-2026Last modified 08-05-2026
Vulnerability summary
CVE-2025-69691 is a critical (CVSS 9.9) Improper Access Control vulnerability in pfsense. EPSS estimates a 0.68% chance of exploitation in the next 30 days, higher than 51.6% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.9/10
010
Critical · v3.1 (CVE.org)EPSS score
0.68%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Timeline
- 08-05-2026PublishedVulnerability first disclosed.
- 08-05-2026Last modifiedVulnerability information updated.
Description
Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code.
CVSS metrics
2 scores · 2 sources · 1 versionCritical 9.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSourcesAll 2 agree
- NVDNIST9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.68%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
0.00 pp
From 0.68% on 21-09-2026
21-09-202621-10-2026
EPSS score0.68%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (seclists.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-915Improperly Controlled Modification of Dynamically-Determined Object AttributesThe product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Affected systems
Pfsense1 product
- pfsense2.8.0
1 vendor · 1 product
References
2 links- www.linkedin.com/in/nelson-adhepeau/Not Applicable