CVE-2025-65176
📋 TL;DR
Dynatrace OneAgent versions before 1.325.47 automatically retry failed network share access attempts using all available user tokens, enabling NTLM relay attacks. This allows unprivileged attackers on affected systems to impersonate other users and potentially gain unauthorized access to network resources. Organizations using vulnerable OneAgent versions are at risk.
💻 Affected Systems
- Dynatrace OneAgent
📦 What is this software?
Oneagent by Dynatrace
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains domain administrator privileges via NTLM relay, leading to full domain compromise and data exfiltration.
Likely Case
Attacker gains access to sensitive network shares, internal applications, or lateral movement capabilities using stolen credentials.
If Mitigated
Limited impact due to network segmentation, SMB signing enforcement, and proper access controls preventing credential relay.
🎯 Exploit Status
Requires attacker to have local access to trigger the vulnerability and set up NTLM relay infrastructure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.325.47
Vendor Advisory: https://docs.dynatrace.com/docs/shortlink/release-notes-oneagent-sprint-325#oneagent-sprint-325-ga
Restart Required: Yes
Instructions:
1. Log into Dynatrace SaaS/Managed environment
2. Navigate to Deploy Dynatrace > OneAgent
3. Update OneAgent to version 1.325.47 or later
4. Restart affected systems or services
🔧 Temporary Workarounds
Disable NTLM Authentication
windowsConfigure systems to use Kerberos authentication only, preventing NTLM relay attacks
Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Network security: Restrict NTLM: Incoming NTLM traffic = Deny all
Enable SMB Signing
windowsRequire SMB packet signing to prevent NTLM relay attacks
Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Microsoft network server: Digitally sign communications (always) = Enabled
🧯 If You Can't Patch
- Implement network segmentation to isolate OneAgent systems from critical resources
- Deploy endpoint detection and response (EDR) solutions to monitor for NTLM relay attempts
🔍 How to Verify
Check if Vulnerable:
Check OneAgent version via Dynatrace UI: Deploy Dynatrace > OneAgent > Version column, or run: 'C:\Program Files\Dynatrace\OneAgent\agent\lib64\oneagentwatchdog.exe --version' on Windows or '/opt/dynatrace/oneagent/agent/lib64/oneagentwatchdog --version' on LinuxCheck Version:
Windows: 'C:\Program Files\Dynatrace\OneAgent\agent\lib64\oneagentwatchdog.exe --version' | Linux: '/opt/dynatrace/oneagent/agent/lib64/oneagentwatchdog --version'Verify Fix Applied:
Confirm version is 1.325.47 or higher using the version check command📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts from single source with different user tokens
- Event ID 4625 (failed logon) with STATUS_LOGON_FAILURE
- Unusual SMB traffic patterns from OneAgent systems
Network Indicators:
- NTLM authentication attempts to unexpected destinations
- SMB traffic without signing from OneAgent systems
- Authentication requests with multiple user contexts from single IP
SIEM Query:
source="windows-security" EventCode=4625 Status="0xc000006d" | stats count by src_ip, user