Critical severity9.1NVD Advisory· Published May 8, 2026· Updated May 12, 2026

CVE-2025-69690

Description

Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pfsense/Pfsense
cpe:2.3:a:pfsense:pfsense:2.7.2:*:*:*:community:*:*:*
Netgate/Pfsensellm-fuzzy
Range: = 2.7.2

Patches

Vulnerability mechanics

References

seclists.org/fulldisclosure/2026/Feb/16nvdExploitMailing ListThird Party Advisory
www.linkedin.com/in/nelson-adhepeau/nvdNot Applicable

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000