CVE-2025-34026
CriticalExploitedPublic exploitThe Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints.
Published May 21, 2025 · Updated Jan 23, 2026
Key Facts
Patch immediately- CVE-2025-34026 is a critical-severity vulnerability (CVSS 9.2 v4) affecting Concerto (Versa-Networks).
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jun 7, 2025. Public exploit code is available.
- EPSS estimates a 82% probability of exploitation in the next 30 days.
- Fixed versions are available, including Concerto 12.1.2.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v4
9.2
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (30-day exploit likelihood)
82%
Higher than 99.6% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2025-34026 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Jan 22, 2026 | Feb 12, 2026 | Not reported |
| Industry KEV feed | Jun 7, 2025 | Feb 12, 2026 | Not reported |
| CIRCL KEV | Jul 21, 2025 | Feb 12, 2026 | Not reported |
| ENISA EUVD | Jan 22, 2026 | n/a | Not reported |
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected Products
4 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| ConcertoVersa-Networks | 12.1.2, 12.2.0, >= 12.1.2 | 12.1.2 |
Patched Releases
Concerto
12.1.2
Timeline
Publicly disclosed
May 21, 2025
Added to Industry KEV feed
Jun 7, 2025
Added to CIRCL KEV
Jul 21, 2025
Added to CISA KEV
Jan 22, 2026
Added to ENISA EUVD
Jan 22, 2026
Last updated
Jan 23, 2026
Weakness Type
- CWE-288 Authentication Bypass Using an Alternate Path or Channel
References
- advisoryhttps://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2e
- exploitVulnCheck exploitation report
- exploitVulnCheck exploitation report
- exploitVulnCheck exploitation report
- exploitVulnCheck exploitation report
FAQ
Common Questions.
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints.
Affected: Concerto (Versa-Networks) versions 12.1.2, 12.2.0, >= 12.1.2. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jun 7, 2025.
Yes. It was added on Jan 22, 2026 with a federal remediation due date of Feb 12, 2026.
Public exploit code is available.
Fixed versions are available, including Concerto 12.1.2.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2025-34026 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo