{"id":"CVE-2025-34026","kind":"vulnerability","aliases":["CVE-2025-34026"],"related":[],"title":"versa-networks concerto: The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse…","description":"Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Versa Concerto, an SD-WAN orchestration platform, has an authentication bypass in its Traefik reverse proxy configuration that exposes an internal Actuator endpoint. An attacker who reaches that endpoint can read heap dumps and trace logs, which can contain credentials and session data.","severity":"critical","cvss":9.2,"epss":null,"exploited":true,"exploited_at":"2026-01-22T00:00:00+00:00","products":[{"name":"Versa Concerto","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"versa-networks concerto","fixed":["12.1.2"],"affected":">= 11.4.0, < 12.1.2","ecosystem":"vendor"},{"name":"versa-networks concerto","fixed":[],"affected":"= 12.1.2","ecosystem":"vendor"},{"name":"versa-networks concerto","fixed":[],"affected":"= 12.2.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","sd-wan","self-hosted","vendor","versa-concerto"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigations per vendor instructions (CISA KEV); if mitigations are unavailable, discontinue use of the product.","status":"open","published_at":"2025-05-21T22:15:50+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:42:35+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:42:35Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations per vendor instructions (CISA KEV); if mitigations are unavailable, discontinue use of the product.","reach":"unknown","summary":"Versa Concerto, an SD-WAN orchestration platform, has an authentication bypass in its Traefik reverse proxy configuration that exposes an internal Actuator endpoint. An attacker who reaches that endpoint can read heap dumps and trace logs, which can contain credentials and session data.","category":"vendor","who_cares":["versa-concerto","sd-wan","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads heap dumps and trace logs, possibly exposing credentials and admin access.","analyst_note":"Find the Versa vendor advisory for exact affected versions, the specific mitigation steps, and how to tell whether the Actuator endpoint is exposed; the KEV entry alone does not say.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000453,"input_tokens":2569,"output_tokens":393,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':150C '-2025':24A,27A '-34026':25A,28A '22':149C 'access':120C,131C 'action':140C 'actuat':76B,125C 'administr':121C 'allow':116C 'appli':141C 'applic':147C 'attack':79B,118C 'authent':17A,64B,108C 'bod':148C 'bypass':18A,65B 'cisa':138C 'cloud':153C 'concerto':4A,7A,30A,34A,38A,42A,53B,55B,99C 'configur':71B,115C 'contain':93B,105C 'credenti':94B 'cve':23A,26A 'data':97B 'discontinu':156C 'dump':87B,134C 'endpoint':77B,83B,122C,126C 'exploit':43B 'expos':73B 'follow':146C 'guidanc':151C 'heap':86B,133C 'host':49B 'improp':107C 'instruct':145C 'intern':75B,124C 'leverag':129C 'log':90B,137C 'mitig':142C,162C 'network':3A 'networks':33A,37A,41A 'orchestr':11A,60B,103C 'per':143C 'platform':12A,61B,104C 'product':160C 'proxi':70B,114C 'reach':81B 'read':85B 'requir':139C 'revers':22A,69B,113C 'sd':9A,45B,58B,101C 'sd-wan':8A,44B,57B,100C 'self':48B 'self-host':47B 'servic':154C 'session':96B 'trace':89B,136C 'traefik':21A,68B,112C 'unavail':164C 'use':157C 'vendor':50B,144C 'versa':2A,6A,29A,32A,36A,40A,52B,54B,98C 'versa-concerto':51B 'versa-network':1A 'versa-networks':31A,35A,39A 'vulner':14A,109C 'wan':10A,46B,59B,102C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-05-21T22:15:50+00:00","kev":{"dateAdded":"2026-01-22","dueDate":"2026-02-12","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-34026","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-34026","severity":null,"published_at":"2026-01-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-34026","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-34026","severity":null,"published_at":"2025-05-21T22:15:50+00:00","modified_at":"2026-06-17T09:13:19+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}