CVE-2025-34026

Versa Concerto Improper Authentication Vulnerability

Versa — Concerto

Added to KEV catalog: 22 January 2026
Federal remediation due date: 12 February 2026
Weakness classification (CWE): CWE-288

CISA Description

Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2e ; https://nvd.nist.gov/vuln/detail/CVE-2025-34026

View on NVD View on MITRE CVE View full CISA catalog

More Versa Vulnerabilities

CVE-2024-39717

Versa Director Dangerous File Type Upload Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services