Versa Concerto Improper Authentication Vulnerability

Technical Severity

CVSS v3.1 Metrics

HIGH

7.5 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitation Likelihood

EPSS Prediction

75.05 %

Predictive Probability

Percentile Rank

98.9 th

Documented as more likely to be exploited than 98.9% of known CVEs.

Detection Date

Jan 22, 2026

Remediation Due

Feb 12, 2026

CISA Catalog Active

Threat Analysis

Versa Concerto SD-WAN orchestration platform contains an improper authentication vulnerability in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.

Remediation Directive

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

External Intelligence

https://security-portal.versa-networks.com/emailbulletins/6830f94328defa375486ff2e

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2025-34026