CVE-2025-34026

UNKNOWNKnown Exploited

CISA Known Exploited Vulnerability

https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2e ; https://nvd.nist.gov/vuln/detail/CVE-2025-34026

Remediation deadline: February 12, 2026

Description

Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.

Timeline

Published:January 22nd, 2026 12:00 AM

Last modified:January 22nd, 2026 12:00 AM

Added to KEV:January 22nd, 2026

CVSS Scoring

No CVSS v3 score available

Affected Software

From NVD CPE configuration data

Vendors

Versa

Products

Concerto

Weaknesses (CWE)

CWE-288

References & Reports

Advisories, patches, and third-party reports

No references available.

Source: CISA KEV + NVD · Data may lag official sources by up to one minute