CVE-2026-44964

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44964", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-05-08T15:00:02.447Z", "datePublished": "2026-08-07T18:02:35.145Z", "dateUpdated": "2026-08-08T01:05:53.334Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID, and an arbitrary Intent to run inside the Datadog process.\r\nThis requires:\r\nA malicious application co-installed on the victim's device.\r\nAn active Datadog session in the Android app.\r\nImpact: After a single tap on the Acknowledge button, the app sends a forged on-call acknowledgement to the backend under the victim's session, launches the attacker-supplied Intent from within the Datadog process (reaching otherwise non-exported components), and turns on the screen while dismissing the keyguard."}], "affected": [{"defaultStatus": "unaffected", "vendor": "Datadog", "product": "Android App", "versions": [{"version": "5.9.2", "status": "affected", "lessThan": "5.9.2", "versionType": "semver"}]}], "references": [{"url": "https://developer.android.com/guide/topics/manifest/activity-element#exported"}, {"url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-441", "description": "CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')"}]}], "credits": [{"lang": "en", "value": "Mark Esler (https://github.com/eslerm)", "type": "finder"}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-08-08T01:05:53.334Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T18:36:41.651155Z", "id": "CVE-2026-44964", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T18:37:01.344Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-44964", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T18:36:41.651155Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T18:36:56.762Z"}}], "cna": {"credits": [{"lang": "en", "type": "finder", "value": "Mark Esler (https://github.com/eslerm)"}], "affected": [{"vendor": "Datadog", "product": "Android App", "versions": [{"status": "affected", "version": "5.9.2", "lessThan": "5.9.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://developer.android.com/guide/topics/manifest/activity-element#exported"}, {"url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"}], "descriptions": [{"lang": "en", "value": "In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID, and an arbitrary Intent to run inside the Datadog process.\r\nThis requires:\r\nA malicious application co-installed on the victim's device.\r\nAn active Datadog session in the Android app.\r\nImpact: After a single tap on the Acknowledge button, the app sends a forged on-call acknowledgement to the backend under the victim's session, launches the attacker-supplied Intent from within the Datadog process (reaching otherwise non-exported components), and turns on the screen while dismissing the keyguard."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-441", "description": "CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-08-08T01:05:53.334Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44964", "state": "PUBLISHED", "dateUpdated": "2026-08-08T01:05:53.334Z", "dateReserved": "2026-05-08T15:00:02.447Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2026-08-07T18:02:35.145Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Android App", "vendor": "Datadog", "versions": [{"lessThan": "5.9.2", "status": "affected", "version": "5.9.2", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID, and an arbitrary Intent to run inside the Datadog process.\r\nThis requires:\r\nA malicious application co-installed on the victim's device.\r\nAn active Datadog session in the Android app.\r\nImpact: After a single tap on the Acknowledge button, the app sends a forged on-call acknowledgement to the backend under the victim's session, launches the attacker-supplied Intent from within the Datadog process (reaching otherwise non-exported components), and turns on the screen while dismissing the keyguard."}, {"lang": "es", "value": "En versiones de la aplicaci\u00f3n de Android de Datadog anteriores a la v545-5.9.2, OnCallNotificationActivity se declara exportada sin una protecci\u00f3n de permisos. Una aplicaci\u00f3n co-instalada puede lanzarla con extras de Intent controlados por el atacante, incluyendo un mensaje de pantalla completa en la pantalla de bloqueo, un ID de p\u00e1gina de guardia arbitrario y un Intent arbitrario para ejecutar dentro del proceso de Datadog.\nEsto requiere:\nUna aplicaci\u00f3n maliciosa co-instalada en el dispositivo de la v\u00edctima.\nUna sesi\u00f3n de Datadog activa en la aplicaci\u00f3n de Android.\nImpacto: Despu\u00e9s de un solo toque en el bot\u00f3n Acknowledge, la aplicaci\u00f3n env\u00eda un reconocimiento de guardia falsificado al backend bajo la sesi\u00f3n de la v\u00edctima, lanza el Intent proporcionado por el atacante desde dentro del proceso de Datadog (alcanzando componentes que de otro modo no ser\u00edan exportados) y enciende la pantalla mientras descarta el keyguard."}], "id": "CVE-2026-44964", "lastModified": "2026-10-23T20:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44964", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T18:36:41.651155Z", "version": "2.0.3"}}]}, "published": "2026-08-07T18:17:14.570", "references": [{"source": "support@hackerone.com", "url": "https://developer.android.com/guide/topics/manifest/activity-element#exported"}, {"source": "support@hackerone.com", "url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-441"}], "source": "support@hackerone.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.9.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Android App", "source": "cna", "vendor": "Datadog"}, "product": "android_app", "vendor": "datadog"}], "created": "2026-08-07T20:15:04.473277+00:00", "title": "Exported Activity Without Permission Guard Enables Forged On\u2011Call Acknowledgements in Datadog Android App", "updated": "2026-08-08T20:40:49.005135+00:00", "vendors": ["datadog", "datadog$PRODUCT$android_app"]}