CVE-2025-34026
Versa Concerto Improper Authentication Vulnerability
Description
CVE-2025-34026 is a high-severity authentication bypass vulnerability in the Versa Concerto SD-WAN orchestration platform. The vulnerability exists in the Traefik reverse proxy configuration, which allows an attacker to access administrative endpoints without authentication. The internal Actuator endpoint can be leveraged to access heap dumps and trace logs, exposing sensitive runtime data. With a CVSS v3.1 base score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), the flaw affects Versa Concerto versions from 11.4.0 through 12.2.0, including 12.1.2 and 12.2.0. It is listed in CISA's KEV catalog with a remediation deadline of February 12, 2026, and carries an EPSS score of 0.56994 (98.1st percentile), indicating extremely high exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| versa-networks | concerto | >= 11.4.0, < 12.1.2; 12.1.2; 12.2.0 |
References
- https://projectdiscovery.io/blog/versa-concerto-authentication-bypass-rce(Exploit, Mitigation, Third Party Advisory)
- https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2e(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-34026(US Government Resource)
Weakness Type
CWE-288: Authentication Bypass Using an Alternate Path or Channel
CVE-2025-34026 is classified under CWE-288, which describes software that uses multiple authentication pathways or channels where one pathway does not enforce the same level of security as the primary one. In the case of Versa Concerto, the Traefik reverse proxy that fronts the application is misconfigured such that certain routes to internal administrative endpoints are not subject to the same authentication requirements as the primary web interface. An attacker can access the Spring Boot Actuator endpoints, which expose sensitive operational data including heap dumps and trace logs, by routing requests through paths that bypass the authentication middleware. Learn more about CWE-288
Impact Analysis
Unauthorized Access to Sensitive Runtime Data is the immediate impact of CVE-2025-34026. The exposed Actuator endpoints provide access to heap dumps that contain in-memory data of the running application, including credentials, session tokens, encryption keys, and configuration data. Trace logs may reveal API call patterns, internal service communications, and user activity.
Confidentiality Impact is maximum (C:H). Heap dumps from a Java-based application like Versa Concerto can contain an enormous amount of sensitive information stored in memory at the time of the dump. This includes administrator passwords, API tokens, session identifiers, TLS certificates and private keys, database connection strings, and any data currently being processed by the application. Access to this information can enable further attacks against the Concerto platform and the managed network infrastructure.
Integrity Impact is none (I:N) for this specific vulnerability. CVE-2025-34026 by itself provides read-only access to the Actuator endpoints and does not directly allow modification of data or system configuration. However, the credentials and tokens extracted from heap dumps can be used to authenticate to the management interface and gain full read-write access to the orchestration platform.
Availability Impact is none (A:N). The vulnerability does not directly impact the availability of the Concerto platform or managed network devices.
SD-WAN Orchestration Context: Versa Concerto is an SD-WAN orchestration platform that manages wide-area network configurations across an organization's branch offices and data centers. Compromising the orchestration platform through extracted credentials could give an attacker control over the entire SD-WAN fabric, enabling traffic interception, network disruption, and lateral movement across the organization. The EPSS score of 0.56994 (98.1st percentile) reflects the critical nature of this attack surface. CISA lists the ransomware association as "Unknown."
Exploit Maturity
CVE-2025-34026 is confirmed as actively exploited, as evidenced by its inclusion in CISA's KEV catalog with a remediation deadline of February 12, 2026. The EPSS score of 0.56994 places it in the 98.1st percentile, indicating that it is among the most actively targeted vulnerabilities.
Public Exploit and Research: Project Discovery has published a detailed technical analysis and exploit that covers not only this authentication bypass but also demonstrates how it can be chained with other vulnerabilities to achieve remote code execution on the Concerto platform. The availability of a comprehensive public exploit with RCE capability significantly elevates the threat level.
Exploitation Simplicity: The authentication bypass exploits a misconfiguration in the Traefik reverse proxy, meaning exploitation requires only crafting HTTP requests with specific routing patterns that reach the unprotected Actuator endpoints. No sophisticated exploitation technique is needed. The attacker simply navigates or sends requests to the alternate paths that bypass Traefik's authentication enforcement.
Vendor Response: Versa Networks has published a security bulletin through their security portal addressing this vulnerability. This indicates vendor acknowledgment and availability of remediation.
Ransomware Association: CISA lists the ransomware association as "Unknown." However, the ability to access credentials for an SD-WAN orchestration platform and potentially achieve RCE through exploit chaining makes this vulnerability a valuable entry point for ransomware operators targeting network infrastructure.
Remediation
-
Apply the Versa Networks security update for Concerto immediately. Consult the Versa security bulletin for the specific patch or updated version that addresses the Traefik misconfiguration. Upgrade to a version newer than 12.2.0 that includes the fix for the authentication bypass.
-
Restrict network access to the Concerto management interface as an emergency mitigation. Use firewall rules to ensure that only authorized administrator workstations can reach the Concerto web interface. Block all public internet access to the management platform. The Actuator endpoints should never be accessible from untrusted networks.
-
Rotate all credentials and tokens that may have been exposed through Actuator heap dumps. This includes administrator passwords, API keys, TLS certificates, database credentials, and any other secrets stored in the Concerto application's memory. Assume that if the vulnerability was accessible, an attacker may have already extracted these credentials.
-
Disable or restrict Spring Boot Actuator endpoints at the application level as a defense-in-depth measure. Configure the Concerto application to expose only the minimum required Actuator endpoints (such as health checks) and require authentication for all others. The heap dump and trace endpoints should be completely disabled in production environments.
-
Audit access logs for the Concerto platform to identify potential exploitation. Look for requests to Actuator endpoint paths such as /actuator/heapdump, /actuator/trace, /actuator/env, and other Actuator endpoints. Review authentication logs for any unauthorized access using credentials that may have been extracted from heap dumps. Monitor the SD-WAN network for any unauthorized configuration changes.
Technical Details
CVE-2025-34026 is an authentication bypass vulnerability in the Versa Concerto SD-WAN orchestration platform caused by a misconfiguration in the Traefik reverse proxy that fronts the application. The vulnerability affects Concerto versions 11.4.0 through 12.2.0.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields a score of 7.5. The attack is network-based (AV:N) with low complexity (AC:L), requires no privileges (PR:N) or user interaction (UI:N). The scope is unchanged (S:U), confidentiality impact is high (C:H), while integrity and availability are not directly affected (I:N/A:N).
Architecture and Misconfiguration: Versa Concerto uses Traefik as a reverse proxy to handle incoming HTTP requests and enforce authentication before routing them to the backend application. The application exposes Spring Boot Actuator endpoints for operational monitoring and management. In the vulnerable configuration, the Traefik routing rules do not properly enforce authentication for all paths that can reach the Actuator endpoints. An attacker can craft requests that are routed through an alternate path that bypasses Traefik's authentication middleware, reaching the Actuator endpoints directly.
Exposed Actuator Endpoints: The Spring Boot Actuator framework provides several endpoints that expose sensitive runtime information. The most critical for this vulnerability are the heap dump endpoint (/actuator/heapdump), which provides a complete snapshot of the Java application's heap memory, and the trace/httptrace endpoint, which logs recent HTTP request and response details. The heap dump contains all objects currently in memory, including string values that represent credentials, tokens, encryption keys, and application configuration.
Exploitation Path: As detailed by Project Discovery, the authentication bypass can be chained with other vulnerabilities to achieve remote code execution. The typical attack flow begins with accessing the Actuator endpoint to obtain heap dumps, extracting credentials and session tokens from the dump, and then using these credentials to authenticate to the management interface. From the authenticated management position, additional vulnerabilities or features can be leveraged to achieve code execution on the underlying system.
Affected Versions: The vulnerability is confirmed to affect Versa Concerto versions from 11.4.0 through 12.2.0, including specifically versions 12.1.2 and 12.2.0. The vendor advisory notes that additional versions may also be vulnerable.
Frequently Asked Questions
What is CVE-2025-34026?
CVE-2025-34026 is an authentication bypass vulnerability in the Versa Concerto SD-WAN orchestration platform. A misconfiguration in the Traefik reverse proxy allows unauthenticated access to internal Actuator endpoints, which expose heap dumps and trace logs containing sensitive data including credentials, session tokens, and encryption keys.
What data can an attacker access through this vulnerability?
The Spring Boot Actuator heap dump endpoint exposes the entire Java heap memory of the running application. This can include administrator passwords, API keys, session tokens, TLS private keys, database connection strings, and any other sensitive data stored in the application's memory. Trace logs can reveal API call patterns and internal service communications.
Can this vulnerability lead to remote code execution?
While CVE-2025-34026 itself only provides read access to Actuator endpoints, researchers at Project Discovery have demonstrated that it can be chained with other vulnerabilities to achieve full remote code execution on the Concerto platform. Credentials extracted from heap dumps can also be used to authenticate and access administrative features that enable further exploitation.
Which Versa Concerto versions are affected?
The vulnerability affects Versa Concerto versions from 11.4.0 through 12.2.0, including 12.1.2 and 12.2.0. The vendor notes that additional versions may also be vulnerable. Organizations should update to the latest patched version available from Versa Networks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.