Versa Concerto is currently under active exploitation, allowing unauthenticated attackers to bypass authentication and achieve remote code execution.

This critical vulnerability stems from URL decoding inconsistencies between the Traefik reverse proxy and the underlying Spring Boot application, resulting in an authentication bypass (CWE-288). An unauthenticated attacker can exploit this flaw to access sensitive administrative endpoints, including Spring Boot Actuator, and chain it with arbitrary file write vulnerabilities to achieve remote code execution.

The exploitation of this vulnerability poses a severe risk to organizational integrity, as it allows for the full compromise of the SD-WAN orchestration platform and the underlying host system. With a CVSS score of 9.5, the potential for unauthorized access, lateral movement, and complete data exfiltration is extremely high. Given the active exploitation observed in the wild, organizations face immediate threats to their network security infrastructure and internal data confidentiality.

Immediate Action: Update Versa Concerto to version 12.2.1 GA immediately to resolve the authentication bypass and associated security flaws.

Proactive Monitoring: Monitor network traffic for anomalous requests targeting the /actuator endpoint or unusual URL patterns containing encoded characters like %2f. Review system logs for unauthorized file writes within the /var/versa/ecp/share/files/ directory.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to block suspicious requests targeting administrative Spring Boot endpoints and sanitize incoming request URIs to prevent bypass attempts.

Public Exploit Available: Yes, a public proof-of-concept exists in the form of Nuclei templates, as documented by ProjectDiscovery.

The severity of CVE-2025-34026 cannot be overstated, particularly due to its inclusion in the CISA Known Exploited Vulnerabilities catalog. Administrators must prioritize the deployment of version 12.2.1 GA above all other maintenance tasks. Failure to patch this vulnerability leaves the orchestration platform exposed to attackers capable of executing arbitrary code, which could result in a total compromise of the enterprise network environment.