CVE-2025-34027 is a critical (CVSS 9.0) authentication bypass in the Versa Concerto SD-WAN orchestration platform that can be chained into unauthenticated remote code execution. It affects Concerto 12.1.2 through 12.2.0, and possibly more. Apply the vendor hot fixes and check the Versa bulletin for versions.
What's affected
The record says the issue is known to affect Versa Concerto from 12.1.2 through 12.2.0 and that additional versions may be vulnerable. The ProjectDiscovery write up says Versa released hot fixes on 7 March 2025 for the issues it reported, but it does not list fixed version numbers. Check the Versa security bulletin for the exact builds that carry the fix.
The same research covers two companion CVEs, CVE-2025-34025 (a container escape) and CVE-2025-34026 (an actuator access bypass). Review them together, since the vendor fixes were shipped as a set.
How to check if you're exposed
Log in to the Concerto administration interface and note the version. Anything from 12.1.2 through 12.2.0 is in the stated range, and later or earlier builds should be checked against the bulletin.
Then check exposure. The orchestrator should not be reachable from the internet. Review firewall and load balancer rules for the Concerto address, and look at reverse proxy logs for requests that carry unusual encoded characters in the path or semicolons in URLs.
If you use the temporary measures from the ProjectDiscovery post, record them so you can remove them once patched. The post suggests blocking requests with semicolons in URL paths and dropping requests whose Connection header names X-Real-Ip. Treat both as interim steps, not a fix.
This is a shipped product or appliance, not a package you import, so a manifest scan will not list it. Use your asset inventory, procurement records or network discovery to find every instance, then compare the version you find against the fixed version in the vendor notes. Safeguard's free in-browser dependency scan and the Gold directory are useful for the open source parts of your estate, and you can look up this CVE in Gold to see how it is tracked.
What to do now
- Identify every Versa Concerto instance and its version.
- Apply the Versa hot fix or upgrade to a release the vendor lists as fixed. Confirm the build number in the bulletin.
- Remove internet exposure of the orchestrator and limit management access to trusted networks.
- Until patched, consider the proxy level filters described in the ProjectDiscovery write up, and test them first.
- Review logs for unexpected requests to administrative endpoints and for newly uploaded files, and treat any hit as an incident.
- Rotate credentials and tokens stored on the orchestrator if you find signs of abuse.
Why it matters
The record classifies the race condition as CWE-367, time-of-check to time-of-use. The ProjectDiscovery analysis explains the authentication part: the filter decodes the request path when it checks excluded paths, but the controller receives the undecoded path, so the two disagree about which resource is being requested. An upload endpoint that allowed arbitrary file writes was then used as the second step to reach code execution.
This is the pattern to remember. When two components parse the same input differently, a check can pass on one view and the action can run on another. The page does not say whether the flaw is exploited in the wild, and the record does not flag it as a CISA KEV entry. An SD-WAN orchestrator holds the keys to many sites, so a quick patch is worth the effort.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Concerto versions does the record name?
12.1.2 through 12.2.0, with a note that additional versions may be vulnerable.
Are the proxy filters a fix?
No. The research describes them as temporary. Apply the vendor hot fix.
Sources
Last reviewed: 18 October 2026.
