7.5high
CVE-2025-34026KEVin critical feed
Versa Concerto Actuator Authentication Bypass Information Leak
Published 17 mo ago · modified 4 mo ago · JSON
CVSS
7.5
v3.1 · NVD
CISA KEV
Yes
added 2026-01-22
EPSS
81.8%
percentile 100%
Public exploits
0
none known
Summary
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.
Known exploited (CISA KEV)
- Added
- 9 mo ago
- Due date
- 2026-02-12 (8 mo ago)
- Ransomware use
- Unknown
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Vendor / product
- Versa / Concerto
- CISA name
- Versa Concerto Improper Authentication Vulnerability
CISA SSVC assessment
- Exploitation
- Active — exploited in the wild
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 9 mo ago
Exploit prediction (EPSS)
81.78% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N |
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
- Versa Concerto
Classification
- Weakness
- CWE-288 Authentication Bypass Using an Alternate Path or Channel
References
- projectdiscovery.io /blog/versa-concerto-authentication-bypass-rce · exploit, mitigation
- cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34026 · government-resource
- security-portal.versa-networks.com /emailbulletins/6830f94328defa375486ff2e · vendor-advisory
Sources
- CVE List: CVE-2025-34026
- NVD: CVE-2025-34026
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.