Metraipolis › archive › dc_eb3d1eb87bfa

KEV CVE-2025-34026: Versa Concerto — Versa Concerto Improper Authentication Vulnerability

Source: CISA KEV
Original: https://nvd.nist.gov/vuln/detail/CVE-2025-34026
License (as archived): CC0-1.0
Archived: 2026-10-18T15:31:04.297Z
SHA-256 of the archived text: 6850a83a5e49edbb11285367c10eef73d354c6a61f6932037b3af9198f4a112b
Stable URL of this page: https://metraipolis.com/documento/dc_eb3d1eb87bfa

How to cite

KEV CVE-2025-34026: Versa Concerto — Versa Concerto Improper Authentication Vulnerability — CISA KEV, https://nvd.nist.gov/vuln/detail/CVE-2025-34026 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_eb3d1eb87bfa (Metraipolis archive dc_eb3d1eb87bfa, sha256 6850a83a5e49edbb11285367c10eef73d354c6a61f6932037b3af9198f4a112b)

BibTeX

@misc{dceb3d1eb87bfa,
  title = {KEV CVE-2025-34026: Versa Concerto — Versa Concerto Improper Authentication Vulnerability},
  howpublished = {CISA KEV},
  url = {https://nvd.nist.gov/vuln/detail/CVE-2025-34026},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_eb3d1eb87bfa; sha256 6850a83a5e49edbb11285367c10eef73d354c6a61f6932037b3af9198f4a112b},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: CISA KEV, https://nvd.nist.gov/vuln/detail/CVE-2025-34026. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

CVE-2025-34026 è nel catalogo CISA delle vulnerabilità SFRUTTATE attivamente (Known Exploited Vulnerabilities), aggiunta il 2026-01-22.
Prodotto: Versa Concerto — Versa Concerto Improper Authentication Vulnerability
Descrizione: Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.
Azione richiesta (agenzie federali USA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Scadenza: 2026-02-12.
Uso noto in campagne ransomware: Unknown
Debolezze: CWE-288
Note e riferimenti: https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2e ; https://nvd.nist.gov/vuln/detail/CVE-2025-34026

Fonte: catalogo CISA KEV (CC0 1.0), versione 2026.10.16, consultato il 2026-10-18: https://www.cisa.gov/known-exploited-vulnerabilities-catalog