Is CVE-2025-10230 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-10230 being exploited in the wild.

How severe is CVE-2025-10230?

Critical severity, with a CVSS score of 10, published 7 November 2025.

Which products and versions are affected?

Samba < 4.21.9, 4.22.0 < 4.21.5, 4.23.0 < 4.23.2.

Is there a fix for CVE-2025-10230?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-10230 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-10230?

Check whether you run Samba at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-10230: Samba command injection in WINS hook handling

Q: Which products and versions are affected?

Samba < 4.21.9, 4.22.0 < 4.21.5, 4.23.0 < 4.23.2.

Q: Is there a fix for CVE-2025-10230?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2025-10230 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-10230?

Check whether you run Samba at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-10230 · Severity: critical · CVSS 10 · Published 2025-11-07

Samba, a widely used software for sharing files and managing network identities, contains a critical security flaw in its WINS server component. An unauthenticated attacker can send specially crafted network packets to take complete control of the server. This could lead to the theft of sensitive company data, disruption of network services, or a total takeover of the organization's domain controller.

Technologies: Samba. Vendors: Samba.

Quick answers

Is CVE-2025-10230 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-10230 being exploited in the wild.
How severe is CVE-2025-10230?: Critical severity, with a CVSS score of 10, published 7 November 2025.
Which products and versions are affected?: Samba < 4.21.9, 4.22.0 < 4.21.5, 4.23.0 < 4.23.2.
Is there a fix for CVE-2025-10230?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-10230 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-10230?: Check whether you run Samba at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in Samba's front-end WINS hook handling. The root cause is the failure to properly validate or escape NetBIOS names received from registration packets before passing them to a shell command via the 'wins hook'. An unauthenticated network attacker can exploit this by sending malicious WINS registration packets containing shell metacharacters. Successful exploitation results in remote command execution (RCE) with the privileges of the Samba process, typically on an Active Directory Domain Controller. The vulnerability is addressed in Samba versions 4.21.9, 4.21.5 (for the 4.22 branch), and 4.23.2.

Affected products

Samba Samba < 4.21.9, 4.22.0 < 4.21.5, 4.23.0 < 4.23.2

Timeline

2025-09-10: disclosed: Initial report in Red Hat Bugzilla
2025-11-07: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.