{"id":"versa-concerto-authentication-bypass-attacks-jan-2026","category":"patch","status":"closed","title":"Versa Concerto authentication bypass CVE-2025-34026 used in attacks; fixes available","tldr":"Attackers have exploited a Versa Concerto flaw to reach administrative services without logging in. It affects business network management systems. Ask IT to confirm the fixed release is installed; Versa identifies 12.2.1 GA as a fixed release.","summary":"CVE-2025-34026 lets an attacker reach protected administrative services in Versa Concerto without a valid login. A configuration problem in its Traefik traffic gateway exposes diagnostic services that can reveal memory contents and activity logs. Concerto manages business and service-provider networks. Versa said it supplied a hotfix in March 2025 and a general release in April, identified as 12.2.1 GA in its response to The Hacker News. Initial reports described the flaws as unpatched because researchers had not received confirmation; Versa subsequently clarified that fixes already existed. CISA confirmed exploitation in January 2026, superseding Versa's May 2025 statement that it knew of none. Attackers, victims and ransomware involvement remain unidentified in the reporting reviewed. Later Shadowserver telemetry recorded attempted attacks in July. NVD lists versions 12.1.2 through 12.2.0 and warns others may be affected, but the complete vendor-defined affected build range could not be verified from Versa's bulletin.","action":"Nothing to update on your family's personal devices: this concerns business network management software. If your business or family office uses Versa, ask its IT provider to confirm Concerto runs the fixed 12.2.1 GA release or a supported successor and to check previously exposed installations for compromise.","product":"Versa Concerto business network management platform","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2025-34026"],"tags":["versa","concerto","sd-wan","authentication-bypass","actively-exploited","information-disclosure"],"affected":["Versa Concerto; Versa's public statement does not enumerate affected builds, and its detailed bulletin could not be retrieved"],"fixed":["Versa Concerto 12.2.1 GA, released 16 April 2025, identified in Versa's response to The Hacker News","Customer hotfix made available in March 2025; build identifiers not verified"],"matches":[],"sources":[{"kind":"advisory","title":"Versa Networks statement on Concerto fixes, reproduced by The Hacker News","url":"https://thehackernews.com/2025/05/unpatched-versa-concerto-flaws-let.html","by":"Versa Networks, via The Hacker News","date":"2025-05-22"},{"kind":"news","title":"Unpatched critical bugs in Versa Concerto lead to auth bypass, RCE — updated with Versa's response","url":"https://www.bleepingcomputer.com/news/security/unpatched-critical-bugs-in-versa-concerto-lead-to-auth-bypass-rce/","by":"BleepingComputer","date":"2025-05-23"},{"kind":"news","title":"CISA confirms active exploitation of four enterprise software bugs","url":"https://www.bleepingcomputer.com/news/security/cisa-confirms-active-exploitation-of-four-enterprise-software-bugs/","by":"BleepingComputer","date":"2026-01-23"},{"kind":"advisory","title":"CVE-2025-34026 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2025-34026","by":"NIST NVD","date":"2025-05-21"},{"kind":"research","title":"CVE-2025-34026 vulnerability record and Shadowserver observations","url":"https://vulnerability.circl.lu/vuln/CVE-2025-34026","by":"CIRCL","date":"2026-07-21"}],"started":"2026-01-22","closed":"2026-07-19","created":"2026-11-03T22:35:54.819Z","updated":"2026-11-03T22:35:54.819Z","cve_notes":[{"cve":"CVE-2025-34026","name":"Authentication bypass in Versa Concerto's traffic gateway","what":"An authentication flaw in Versa Concerto's Traefik gateway lets an attacker access protected administrative and diagnostic services without logging in, potentially exposing memory contents and activity logs.","severity":"unknown","cvss":0}],"timeline":[{"at":"2026-07-19","added":"2026-11-03T22:23:31.291Z","kind":"other","text":"CIRCL's vulnerability record includes Shadowserver telemetry recording three honeypot connections associated with this flaw that day. These are attempted attacks, not evidence that three real organisations were compromised.","url":"https://vulnerability.circl.lu/vuln/CVE-2025-34026","by":"CIRCL","patch":null},{"at":"2026-01-22","added":"2026-11-03T22:23:31.291Z","kind":"cisa-added","text":"CISA added CVE-2025-34026 to its Known Exploited Vulnerabilities catalogue, confirming exploitation. It set a 12 February remediation deadline for covered US federal agencies.","url":"https://nvd.nist.gov/vuln/detail/cve-2025-34026","by":"NIST NVD","patch":null},{"at":"2025-05-23","added":"2026-11-03T22:23:31.291Z","kind":"vendor-revised","text":"BleepingComputer added Versa's statement confirming the earlier releases and customer notifications. Versa said it then had no indication of exploitation or reported customer impact.","url":"https://www.bleepingcomputer.com/news/security/unpatched-critical-bugs-in-versa-concerto-lead-to-auth-bypass-rce/","by":"BleepingComputer","patch":null},{"at":"2025-05-21","added":"2026-11-03T22:23:31.291Z","kind":"disclosed","text":"ProjectDiscovery publicly disclosed the vulnerabilities after its disclosure deadline passed without confirmation that fixes were available.","url":"https://www.bleepingcomputer.com/news/security/unpatched-critical-bugs-in-versa-concerto-lead-to-auth-bypass-rce/","by":"BleepingComputer","patch":null},{"at":"2025-04-16","added":"2026-11-03T22:23:31.291Z","kind":"new-fix","text":"Versa says its generally available release containing the fixes reached all customers. The Hacker News identifies this release as Concerto 12.2.1 GA.","url":"https://thehackernews.com/2025/05/unpatched-versa-concerto-flaws-let.html","by":"The Hacker News","patch":"patched"},{"at":"2025-03-07","added":"2026-11-03T22:23:31.291Z","kind":"new-fix","text":"Versa says it completed and validated fixes and made a hotfix available to customers.","url":"https://www.bleepingcomputer.com/news/security/unpatched-critical-bugs-in-versa-concerto-lead-to-auth-bypass-rce/","by":"BleepingComputer","patch":"partial"},{"at":"2025-02-13","added":"2026-11-03T22:23:31.291Z","kind":"other","text":"ProjectDiscovery reported the Concerto vulnerabilities to Versa. Versa subsequently confirmed this date in its statement about the fixes.","url":"https://www.bleepingcomputer.com/news/security/unpatched-critical-bugs-in-versa-concerto-lead-to-auth-bypass-rce/","by":"BleepingComputer","patch":null}],"url":"https://hard.fyi/live/versa-concerto-authentication-bypass-attacks-jan-2026/","json":"https://hard.fyi/api/live?id=versa-concerto-authentication-bypass-attacks-jan-2026"}