CVE-2025-34026

Versa Concerto Actuator Authentication Bypass Information Leak

State: Published
Severity: 9.2 Critical
Published: May 21, 2025
Updated: Jan 23, 2026
Reserved: Apr 15, 2025

Description

The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N	VulnCheck

Weaknesses

CWE-288 Authentication Bypass Using an Alternate Path or Channel

Affected Products

Product	Versions
ConcertoVersa	12.1.2 through 12.2.0Affected

References

https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rceexploitmitigation
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34026government-resource
https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2evendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.