CVE-2025-34026

The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.

CVSS v4.0

9.2 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

81.94% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2026-01-22

Nuclei

critical · CWE-288

Published

2025-05-21

Updated

2026-01-23

Proof-of-concept exploits (1)

• https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-34026.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2025-34025
• CVE-2025-34027
• CVE-2025-34024
• CVE-2025-34028
• CVE-2025-34023
• CVE-2025-34029