CVE-2025-65176

An issue was discovered in Dynatrace OneAgent before 1.325.47. When attempting to access a remote network share from a machine where OneAgent is installed and receiving a "STATUS_LOGON_FAILURE" error, the agent will retrieve every user token on the machine and repeatedly attempt to access the network share while impersonating them. The exploitation of this vulnerability can allow an unprivileged attacker with access to the affected system to perform NTLM relay attacks.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://docs.dynatrace.com/docs/shortlink/release-notes-oneagent-sprint-325#oneagent-sprint-325-ga	Release Notes
https://docs.dynatrace.com/docs/whats-new/oneagent/sprint-325#oneagent-sprint-325-ga	Release Notes
https://hackerone.com/reports/3313408	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dynatrace:oneagent:*:*:*:*:*:*:*:*

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Se descubrió un problema en Dynatrace OneAgent anterior a 1.325.47. Al intentar acceder a un recurso compartido de red remoto desde una máquina donde OneAgent está instalado y al recibir un error 'STATUS_LOGON_FAILURE', el agente recuperará cada token de usuario en la máquina e intentará repetidamente acceder al recurso compartido de red mientras los suplanta. La explotación de esta vulnerabilidad puede permitir a un atacante sin privilegios con acceso al sistema afectado realizar ataques de retransmisión NTLM.

Information

Published : 2025-12-15 19:16

Updated : 2026-10-14 13:10

NVD link : CVE-2025-65176

Mitre link : CVE-2025-65176

CVE.ORG link : CVE-2025-65176

JSON object : View

Products Affected

dynatrace

oneagent

CWE

CWE-284

Improper Access Control

{"id": "CVE-2025-65176", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65176", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-16T15:00:09.793385Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-15T19:16:05.097", "references": [{"url": "https://docs.dynatrace.com/docs/shortlink/release-notes-oneagent-sprint-325#oneagent-sprint-325-ga", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://docs.dynatrace.com/docs/whats-new/oneagent/sprint-325#oneagent-sprint-325-ga", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://hackerone.com/reports/3313408", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Dynatrace OneAgent before 1.325.47. When attempting to access a remote network share from a machine where OneAgent is installed and receiving a \"STATUS_LOGON_FAILURE\" error, the agent will retrieve every user token on the machine and repeatedly attempt to access the network share while impersonating them. The exploitation of this vulnerability can allow an unprivileged attacker with access to the affected system to perform NTLM relay attacks."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Dynatrace OneAgent anterior a 1.325.47. Al intentar acceder a un recurso compartido de red remoto desde una m\u00e1quina donde OneAgent est\u00e1 instalado y al recibir un error 'STATUS_LOGON_FAILURE', el agente recuperar\u00e1 cada token de usuario en la m\u00e1quina e intentar\u00e1 repetidamente acceder al recurso compartido de red mientras los suplanta. La explotaci\u00f3n de esta vulnerabilidad puede permitir a un atacante sin privilegios con acceso al sistema afectado realizar ataques de retransmisi\u00f3n NTLM."}], "lastModified": "2026-10-14T13:10:00.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dynatrace:oneagent:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "595B1C6A-7C56-47BD-9595-0AE82ED8AACD", "versionEndExcluding": "1.325.47"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}