Exploited vulnerability · CISA KEV

Is CVE-2025-34026 exploited? Yes: in CISA KEV since 22 Jan 2026

Gociux · Versa Concerto · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2025-34026, Versa Concerto Improper Authentication Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 22 Jan 2026, 246 days after it was published. It affects Versa Concerto. If you run it, CISA's required action is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

What it is

Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.

What to do

1. Check whether you run it. Look for Concerto in your asset inventory, including appliances and cloud images. Stack check lists every exploited Versa CVE at once.
2. Apply the fix. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 21 May 2025.
4. Get told next time. Email alerts when CISA adds a CVE for Versa.

References

• security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2e
• nvd.nist.gov/vuln/detail/CVE-2025-34026

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in January 2026 · Versa scorecard · act-now radar.