CVE-2026-44964

{
  "id": "CVE-2026-44964",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-07T18:17:14.570",
  "lastModified": "2026-10-23T20:10:00.160",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID, and an arbitrary Intent to run inside the Datadog process.\r\nThis requires:\r\nA malicious application co-installed on the victim's device.\r\nAn active Datadog session in the Android app.\r\nImpact: After a single tap on the Acknowledge button, the app sends a forged on-call acknowledgement to the backend under the victim's session, launches the attacker-supplied Intent from within the Datadog process (reaching otherwise non-exported components), and turns on the screen while dismissing the keyguard."
    },
    {
      "lang": "es",
      "value": "En versiones de la aplicación de Android de Datadog anteriores a la v545-5.9.2, OnCallNotificationActivity se declara exportada sin una protección de permisos. Una aplicación co-instalada puede lanzarla con extras de Intent controlados por el atacante, incluyendo un mensaje de pantalla completa en la pantalla de bloqueo, un ID de página de guardia arbitrario y un Intent arbitrario para ejecutar dentro del proceso de Datadog.\nEsto requiere:\nUna aplicación maliciosa co-instalada en el dispositivo de la víctima.\nUna sesión de Datadog activa en la aplicación de Android.\nImpacto: Después de un solo toque en el botón Acknowledge, la aplicación envía un reconocimiento de guardia falsificado al backend bajo la sesión de la víctima, lanza el Intent proporcionado por el atacante desde dentro del proceso de Datadog (alcanzando componentes que de otro modo no serían exportados) y enciende la pantalla mientras descarta el keyguard."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Datadog",
          "product": "Android App",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "5.9.2",
              "lessThan": "5.9.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T18:36:41.651155Z",
          "id": "CVE-2026-44964",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-441"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://developer.android.com/guide/topics/manifest/activity-element#exported",
      "source": "[email protected]"
    },
    {
      "url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef",
      "source": "[email protected]"
    }
  ]
}