MSRXVulnerabilities / CVE-2025-34026
CVE-2025-34026
Published 2025-05-21 · Analyzed
CVE-2025-34026
Versa Concerto Improper Authentication Vulnerability
Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-22, with a fix-by date of 2026-02-12. Patch it first.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
9.2 CRITICAL
CVSS 4.0 · CNA · vulncheck.com
CVSS 4.0 · CNA · vulncheck.com
82%
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.
Scores
Affected products
- versa-networks concerto: ≥ 11.4.0, < 12.1.2; 12.1.2; 12.2.0
Weakness: CWE-288
3 references (advisories, patches, write-ups)
- https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce · Exploit, Mitigation, Third Party Advisory
- https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2e · Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34026 · US Government Resource
Sources: NVD, CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.