Versa Concerto authentication bypass CVE-2025-34026 used in attacks; fixes available
Attackers have exploited a Versa Concerto flaw to reach administrative services without logging in. It affects business network management systems. Ask IT to confirm the fixed release is installed; Versa identifies 12.2.1 GA as a fixed release.
Nothing to update on your family's personal devices: this concerns business network management software. If your business or family office uses Versa, ask its IT provider to confirm Concerto runs the fixed 12.2.1 GA release or a supported successor and to check previously exposed installations for compromise.
What’s happening
CVE-2025-34026 lets an attacker reach protected administrative services in Versa Concerto without a valid login. A configuration problem in its Traefik traffic gateway exposes diagnostic services that can reveal memory contents and activity logs. Concerto manages business and service-provider networks. Versa said it supplied a hotfix in March 2025 and a general release in April, identified as 12.2.1 GA in its response to The Hacker News. Initial reports described the flaws as unpatched because researchers had not received confirmation; Versa subsequently clarified that fixes already existed. CISA confirmed exploitation in January 2026, superseding Versa's May 2025 statement that it knew of none. Attackers, victims and ransomware involvement remain unidentified in the reporting reviewed. Later Shadowserver telemetry recorded attempted attacks in July. NVD lists versions 12.1.2 through 12.2.0 and warns others may be affected, but the complete vendor-defined affected build range could not be verified from Versa's bulletin.
- What
- Flaw
- Affects
- Versa Concerto business network management platform
- Affected
- Versa Concerto; Versa's public statement does not enumerate affected builds, and its detailed bulletin could not be retrieved
- Fixed in
- Versa Concerto 12.2.1 GA, released 16 April 2025, identified in Versa's response to The Hacker News
Customer hotfix made available in March 2025; build identifiers not verified - Since
- 22 Jan 2026
- Closed
- 19 July 2026
Timeline
- Update
CIRCL's vulnerability record includes Shadowserver telemetry recording three honeypot connections associated with this flaw that day. These are attempted attacks, not evidence that three real organisations were compromised.
- CISA added
CISA added CVE-2025-34026 to its Known Exploited Vulnerabilities catalogue, confirming exploitation. It set a 12 February remediation deadline for covered US federal agencies.
- Vendor revised
BleepingComputer added Versa's statement confirming the earlier releases and customer notifications. Versa said it then had no indication of exploitation or reported customer impact.
- Made public
ProjectDiscovery publicly disclosed the vulnerabilities after its disclosure deadline passed without confirmation that fixes were available.
- New fixFixed
Versa says its generally available release containing the fixes reached all customers. The Hacker News identifies this release as Concerto 12.2.1 GA.
- New fixPartly fixed
Versa says it completed and validated fixes and made a hotfix available to customers.
- Update
ProjectDiscovery reported the Concerto vulnerabilities to Versa. Versa subsequently confirmed this date in its statement about the fixes.
Sources
- Versa Networks statement on Concerto fixes, reproduced by The Hacker NewsVersa Networks, via The Hacker News · 22 May 2025
- Unpatched critical bugs in Versa Concerto lead to auth bypass, RCE — updated with Versa's responseBleepingComputer · 23 May 2025
- CISA confirms active exploitation of four enterprise software bugsBleepingComputer · 23 Jan 2026
- CVE-2025-34026 DetailNIST NVD · 21 May 2025
- CVE-2025-34026 vulnerability record and Shadowserver observationsCIRCL · 21 July 2026