Exploitation Summary
CVE-2025-34026 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added January 22, 2026. A Nuclei detection template is also available.
Description
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto from 12.1.2 through 12.2.0. Additional versions may be vulnerable.
Nuclei Templates (1)
Versa Concerto Actuator Endpoint - Authentication Bypass
CRITICALVERIFIEDby iamnoooob,rootxharsh,parthmalhotra,pdresearch
Shodan:
http.favicon.hash:-534530225
References (3)
Core 3
Core References
Exploit, Mitigation, Third Party Advisory exploit
mitigation
https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce
US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34026
Scores
CVSS v3
7.5
EPSS
0.7108
EPSS Percentile
98.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
active
Automatable
yes
Technical Impact
partial
Details
CISA KEV
2026-01-22
VulnCheck KEV
2025-06-07
ENISA EUVD
EUVD-2025-16087
CWE
CWE-288
Status
published
Products (3)
versa-networks/concerto
12.1.2
versa-networks/concerto
12.2.0
versa-networks/concerto
11.4.0 - 12.1.2
Published
May 21, 2025
KEV Added
Jan 22, 2026
Tracked Since
Feb 18, 2026