External risk intelligence

Dynatrace ActiveGate Ping Extension Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-61304

The vulnerability affects the Dynatrace ActiveGate ping extension. ActiveGate components act as intermediaries between monitored entities and the Dynatrace cluster, typically residing within internal network segments or private infrastructure to facilitate data collection. While they communicate over the network, they are not standard public-facing web applications or edge gateways by design.

OS Command Injection

Dynatrace Activegate Ping Extension

1.016 and earlier

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves Dynatrace ActiveGate's ping extension, which could allow an attacker to inject commands by sending a specially crafted IP address. This issue is significant because the ActiveGate is a critical component for collecting data within your network.

Command injection in Dynatrace ActiveGate ping function.
Potential for unauthorized system command execution.
Confirm if this Dynatrace component is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted IP address to the Dynatrace ActiveGate ping extension. This could allow them to execute arbitrary operating system commands on the affected system.

No authentication or user interaction needed.
Malicious IP address in ping request.
Arbitrary command execution on host.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject and execute arbitrary operating system commands on the Dynatrace ActiveGate by providing a specially crafted IP address. This could potentially impact the integrity and availability of the ActiveGate's operations and any data it processes or transmits.

OS commands on ActiveGate.
Via crafted IP address input.
Service disruption and data integrity risk.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Dynatrace ActiveGate ping extension vulnerability requires immediate attention from teams responsible for Dynatrace deployments and the infrastructure hosting ActiveGate. The first critical step is to identify all instances of the affected extension, confirm their network exposure, and determine if they are business-critical to prioritize remediation efforts.

Dynatrace platform or infrastructure teams own the issue.
Verify ActiveGate ping extension instances and exposure.
Plan remediation based on identified risks.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Dynatrace ActiveGate ping extension?

The ActiveGate ping extension is a component used within the Dynatrace platform to facilitate connectivity checks. It acts as an intermediary, helping gather telemetry and monitor network reachability between your internal infrastructure and the Dynatrace cluster.

What is CWE-78 and how does it relate to CVE-2025-61304?

CWE-78, or OS Command Injection, is a weakness where an application sends unsanitized user-supplied data to a system shell. In this CVE, the ping extension fails to properly validate IP address inputs, allowing an attacker to inject and execute their own operating system commands instead of just performing a network ping.

How does an attacker trigger this vulnerability?

An attacker triggers this by submitting a specially crafted IP address string to the extension's input field. The bug is specifically tied to this malicious input handling; normal, valid IP addresses or standard network traffic do not trigger the command injection.

Is my ActiveGate vulnerable if it is not on the public internet?

According to Halo Surface Signal, ActiveGate components are typically placed within private or internal network segments to act as data collection intermediaries. While this reduces the likelihood of direct public access, the vulnerability remains a risk if an attacker has any network-level reach to the ActiveGate service.

Do I need to check my Dynatrace deployments for this issue?

Yes. If your environment runs versions of the ActiveGate ping extension up to 1.016, you should verify which hosts are running this component. Start by mapping your deployment inventory to confirm if the extension is active, then evaluate the network accessibility of those specific instances to prioritize your updates.

References

github.com/pentastic-be/CVE-2025-61304

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.