Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 8, 2026 · NIST NVD

   Detected

   Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code.

2. Oct 15, 2026 · NIST NVD

   Updated

   Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code.

Affected

• cpe pfsense/pfsense2.8.0

Sources

• CVE.orgVulnerability recordCVE-2025-69691

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2025-69691

  Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code.

  nvd.nist.gov

References

• Exploit · seclists.org
• Not Applicable · linkedin.com