CVE-2025-34026

Versa Concerto, Versa Networks' SD-WAN orchestration and management platform, contains an authentication-bypass flaw (CWE-288) in its Traefik reverse proxy configuration that allows unauthenticated remote attackers to reach administrative endpoints that should require login. The flaw is network-reachable with no privileges or user interaction required, and the internal Actuator endpoint is also reachable, letting attackers pull heap dumps and trace logs that may contain sensitive information. Public research (Project Discovery) demonstrates the bypass can be chained toward remote code execution, and separate Versa Concerto flaws reported publicly have been shown to allow Docker escapes and compromise of the underlying host. Known-affected versions are Concerto 12.1.2 through 12.2.0, with additional versions possibly vulnerable, so any organization running a vulnerable Concerto instance — particularly one exposed to the internet — is at risk. The flaw is confirmed to be exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-22, and EPSS assigns an ~82% probability of exploitation within 30 days (100th percentile).

What to do: Upgrade Concerto to the fixed release per Versa Networks' security advisory — the known-affected range is 12.1.2 through 12.2.0, but because additional versions may be vulnerable, confirm the patched version with the vendor; U.S. federal agencies must apply these mitigations or discontinue use of the product under BOD 22-01. In the meantime, restrict internet exposure of Concerto portals and its administrative/Actuator endpoints, and review trace logs and any evidence of heap-dump access for signs of unauthenticated administrative requests.