CVE-2026-44964 Overview
CVE-2026-44964 affects the Datadog Android application in versions prior to v545-5.9.2. The OnCallNotificationActivity component is declared as exported without a permission guard. A co-installed malicious application can launch this activity with attacker-controlled Intent extras. These extras include a full-screen lock-screen message, an arbitrary on-call page identifier, and an arbitrary Intent that runs inside the Datadog process. Exploitation requires an active Datadog session and a single user tap on the Acknowledge button. The flaw is classified under CWE-441 for unintended proxy or intermediary behavior.
Critical Impact
Attackers can forge on-call acknowledgements under the victim's session and launch arbitrary Intents inside the Datadog process, reaching otherwise non-exported components.
Affected Products
- Datadog Android application versions prior to v545-5.9.2
- Devices with an active Datadog user session
- Android devices allowing co-installed third-party applications
Discovery Timeline
- 2026-08-07 - CVE-2026-44964 published to NVD
- 2026-08-08 - Last updated in NVD database
Technical Details for CVE-2026-44964
Vulnerability Analysis
The vulnerability resides in the Android manifest declaration of OnCallNotificationActivity. The activity is marked as exported and lacks a permission guard. Any co-installed application on the device can invoke this component directly through an explicit Intent. The activity accepts attacker-controlled extras and uses them to render lock-screen content, populate an on-call page ID, and stage an inner Intent for later dispatch.
When the victim taps the Acknowledge button, three chained effects occur. The application sends a forged on-call acknowledgement to the Datadog backend under the victim's authenticated session. The application then launches the attacker-supplied Intent from within the Datadog process context. This reaches components that are not otherwise exported to third-party callers. The activity also turns the screen on and dismisses the keyguard, maximizing the probability of user interaction.
This pattern matches an Intent redirection or confused deputy scenario. The Datadog process acts as an unintended proxy for the malicious caller. See the Android Manifest Activity Guide for the correct use of the android:exported attribute.
Root Cause
The root cause is a missing permission guard on an exported Android activity. The manifest exposes OnCallNotificationActivity to any application on the device. The activity trusts Intent extras without validating the caller identity or restricting the inner Intent target.
Attack Vector
An attacker distributes a co-installed application to the victim's device. That application constructs an Intent targeting OnCallNotificationActivity with crafted extras. The extras contain a persuasive on-call message, a target page ID, and an inner Intent aimed at a non-exported Datadog component. The Datadog activity displays the lock-screen prompt and awaits the Acknowledge tap. A single tap triggers the forged acknowledgement and the inner Intent dispatch. Detailed disclosure is available through the Datadog Trust Center.
// Verified proof-of-concept code is not publicly available.
// See vendor advisory for technical disclosure details.
Detection Methods for CVE-2026-44964
Indicators of Compromise
- Unexpected on-call acknowledgement events in Datadog audit logs originating from user sessions without corresponding paging activity.
- Android system logs showing external startActivity calls targeting OnCallNotificationActivity from non-Datadog package identifiers.
- Lock-screen wake events on managed Android devices correlated with untrusted third-party application installs.
Detection Strategies
- Inventory installed Datadog Android application versions across managed devices and flag any build prior to v545-5.9.2.
- Correlate mobile device management telemetry with Datadog on-call acknowledgement logs to identify unusual acknowledgement patterns.
- Review sideloaded or recently installed Android packages on devices that hold active Datadog sessions.
Monitoring Recommendations
- Ingest Datadog on-call audit events into your security data lake and alert on acknowledgements outside expected on-call rotations.
- Monitor Android application inventory changes on devices used for privileged operations workflows.
- Alert on installations of unvetted applications on devices signed into Datadog corporate accounts.
How to Mitigate CVE-2026-44964
Immediate Actions Required
- Upgrade the Datadog Android application to v545-5.9.2 or later on all devices with active Datadog sessions.
- Audit recent on-call acknowledgement events in Datadog for anomalous entries during the exposure window.
- Restrict installation of untrusted Android applications on devices used to access Datadog on-call functionality.
Patch Information
Datadog addressed the issue in Android application version v545-5.9.2. Update through Google Play or your enterprise mobile application management channel. Confirm the installed build after deployment.
Workarounds
- Sign out of the Datadog Android application on affected devices until the update is installed.
- Enforce an approved application allowlist through mobile device management to block co-installed attacker payloads.
- Educate on-call responders to verify page context before tapping Acknowledge on unexpected notifications.
# Verify installed Datadog Android application version via adb
adb shell dumpsys package com.datadog.android | grep versionName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
