CVE-2025-34026

What it actually does

CVE-2025-34026 is an authentication bypass in the Traefik reverse proxy configuration used by Versa Concerto SD-WAN orchestration platform versions 12.1.2 through 12.2.0, with possible exposure in additional versions. The flaw allows unauthenticated remote access to administrative and internal Spring Boot Actuator endpoints that should only be reachable after authentication or from trusted internal components. An attacker who reaches the exposed reverse proxy path can query sensitive operational endpoints and retrieve artifacts such as heap dumps and trace logs. Heap dumps and request traces may contain session tokens, credentials, API keys, configuration secrets, internal URLs, user data, and application state that can enable deeper compromise of Concerto or connected SD-WAN management infrastructure.

Why it matters to the business

Successful exploitation can expose sensitive management-plane data from a platform that orchestrates SD-WAN infrastructure. This may allow attackers to steal credentials or tokens, map managed network devices, access administrative functions, and support follow-on compromise of network operations. Because this issue is listed in CISA KEV, has active exploitation reported in the wild, and has a high EPSS likelihood score, affected internet-accessible Concerto deployments should be treated as urgent remediation priorities. The CISA remediation due date is 2026-02-12, but organizations should not wait if the management interface is externally reachable.

How an attack unfolds

An attacker first identifies an exposed Versa Concerto instance, typically by scanning for Concerto, Traefik, or recognizable management-plane web responses. Due to the flawed reverse proxy routing configuration, requests that should require authentication can be forwarded directly to administrative or internal Actuator endpoints. The attacker accesses endpoints such as Actuator discovery, heap dump, trace, or HTTP trace routes without valid credentials. They then download heap dumps or view trace logs and search them offline for secrets, bearer tokens, cookies, credentials, API keys, internal hostnames, and administrative request data. If usable secrets are found, the attacker can replay them against Concerto APIs or related management systems, pivot to additional administrative functions, alter SD-WAN orchestration settings, or maintain access using stolen tokens. Public reporting associates exploitation with active in-the-wild activity tracked as a Versa Concerto improper authentication vulnerability campaign.

How to fix it

Upgrade Versa Concerto to a vendor-supported version that fixes the Traefik authentication bypass as soon as an applicable fixed release is available. The known affected range is Concerto 12.1.2 through 12.2.0, and additional versions may be vulnerable, so verify directly against Versa advisories rather than assuming older or adjacent releases are safe. If an immediate upgrade is not possible, restrict access to Concerto management and Traefik entry points to trusted administrative networks or VPNs, block public internet access, and enforce network-layer allowlisting. Disable or strictly protect Spring Boot Actuator endpoints, especially heapdump, trace, httptrace, env, logfile, metrics, mappings, and configprops routes. Ensure Traefik rules do not expose internal backend routes, administrative paths, or Actuator endpoints without authentication. Rotate credentials, API keys, bearer tokens, and session secrets that may have been present in memory or trace logs if exposure is suspected. Review Concerto administrative users, API integrations, and SD-WAN configuration changes for unauthorized activity.

How to confirm the fix worked

Confirm the running Concerto version and compare it with the vendor advisory for affected and fixed versions. From an unauthenticated network location, verify that administrative and Actuator endpoints return 401, 403, or are unreachable, rather than returning endpoint listings, JSON responses, heap dump downloads, logs, or traces. Validate that Traefik routing rules do not forward unauthenticated requests to internal management or Actuator paths. Confirm that management access is restricted by firewall, VPN, security group, reverse proxy policy, or equivalent controls. After remediation, run an authenticated configuration review to ensure Actuator exposure is disabled or restricted to localhost/internal trusted management paths only. If exploitation is suspected, validate that all potentially exposed secrets have been rotated and that old sessions or tokens are invalidated.

Typical attack path

1. Scan the internet or target address ranges for exposed Versa Concerto management interfaces or Traefik-fronted services.
2. Fingerprint reachable services and test whether administrative or Actuator paths are accessible without authentication.
3. Request internal Actuator endpoints such as heap dump, trace, HTTP trace, environment, metrics, or log endpoints through the reverse proxy.
4. Download heap dumps or collect trace responses containing application memory, request metadata, headers, cookies, or tokens.
5. Analyze retrieved artifacts for credentials, API keys, bearer tokens, session cookies, internal URLs, managed device information, and administrative API routes.
6. Use recovered secrets or unauthenticated administrative access to interact with Concerto management functions or related SD-WAN infrastructure.
7. Attempt persistence, configuration changes, lateral movement, or data collection from connected network management systems.

How to detect it

Review web access logs, Traefik logs, reverse proxy logs, application logs, and network telemetry for unauthenticated requests to Actuator or administrative endpoints. Prioritize requests to heap dump and trace endpoints, especially successful 200 responses, large response sizes, compressed downloads, or repeated enumeration of Actuator paths. Look for access to these endpoints from internet IP addresses, unknown scanners, hosting providers, anonymization services, or geographies inconsistent with normal administration. Search for requests that do not include expected authenticated session cookies or authorization headers but still receive successful responses. Review Concerto audit logs for administrative actions shortly after suspicious endpoint access, including new users, changed passwords, modified SD-WAN policies, altered device configurations, API token creation, and unusual login/session activity. If heap dumps or traces were accessed, perform incident response assuming credential exposure: collect relevant logs, identify downloaded artifacts, rotate secrets, invalidate sessions, and inspect downstream systems for token reuse. Network sensors may also detect unusually large downloads from Concerto management endpoints or repeated GET requests against Spring Boot Actuator routes.

• GET /actuator
• GET /actuator/
• GET /actuator/heapdump
• GET /actuator/httptrace
• GET /actuator/trace
• GET /actuator/env
• GET /actuator/logfile
• GET /actuator/loggers
• GET /actuator/metrics
• GET /actuator/mappings
• GET /actuator/configprops
• GET /actuator/beans
• GET /actuator/threaddump
• GET /actuator/scheduledtasks
• GET /actuator/prometheus
• POST /actuator
• POST /actuator/heapdump
• /actuator/heapdump
• /actuator/httptrace
• /actuator/trace
• /actuator/env
• /actuator/logfile
• /actuator/metrics
• /actuator/mappings
• /actuator/configprops
• /actuator/threaddump
• application/vnd.spring-boot.actuator
• heapdump
• java_pid
• hprof
• Traefik
• X-Forwarded-For
• X-Forwarded-Host

What your security team should do

• Treat exposed Versa Concerto instances as high priority because the vulnerability is in CISA KEV, has active in-the-wild exploitation, and has a high EPSS score.
• Immediately inventory Versa Concerto deployments and determine whether versions 12.1.2 through 12.2.0, or other potentially affected releases, are deployed.
• Remove public internet exposure for Concerto and Traefik management paths; require VPN, bastion, or trusted administrative network access.
• Upgrade to a vendor-confirmed fixed release when available and track the CISA KEV remediation deadline of 2026-02-12 as the latest acceptable date for covered organizations.
• Block unauthenticated access to Actuator and administrative endpoints at the reverse proxy, load balancer, firewall, and application layers.
• Search historical access logs for unauthenticated requests to Actuator paths, heap dumps, traces, administrative endpoints, and unusual large downloads.
• If heapdump, trace, or similar endpoints were accessed, assume secrets may have been exposed and rotate application credentials, API keys, session signing material, integration tokens, and administrator passwords.
• Review Concerto administrative audit logs and SD-WAN configuration history for unauthorized changes, new users, modified policies, altered device templates, or suspicious API activity.
• Add SIEM detections for Actuator endpoint access attempts and abnormal downloads from Concerto management interfaces.
• Preserve logs and forensic artifacts before patching or rebuilding if compromise is suspected.