PT-2025-51276 · Dynatrace · Dynatrace Oneagent

Published 2025-12-15 · Updated 2025-12-21 · CVE-2025-65176

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dynatrace OneAgent versions prior to 1.325.47

Description An issue exists in Dynatrace OneAgent where, when attempting to access a remote network share and receiving a "STATUS LOGON FAILURE" error, the agent retrieves all user tokens from the machine and repeatedly attempts network share access while impersonating those users. This can allow an unprivileged attacker with system access to perform NTLM relay attacks.

Recommendations Update Dynatrace OneAgent to version 1.325.47 or later.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-65176

Affected Products

Dynatrace Oneagent

References · 7

• https://osv.dev/vulnerability/CVE-2025-65176 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65176 · Security Note
• https://docs.dynatrace.com/docs/whats-new/oneagent/sprint-325#oneagent-sprint-325-ga · Note
• https://hackerone.com/reports/3313408 · Note
• https://t.me/CVEtracker/39867 · Telegram Post
• https://twitter.com/CVEnew/status/2002857396377661724 · Twitter Post
• https://docs.dynatrace.com/docs/shortlink/release-notes-oneagent-sprint-325#oneagent-sprint-325-ga · Note