Is CVE-2025-10230 actively exploited?

No active exploitation of CVE-2025-10230 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-10230 be exploited remotely?

Yes. CVE-2025-10230 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-10230?

CVE-2025-10230 has a CVSS score of 10.0 (CRITICAL).

HOME VULNERABILITIESCVE-2025-10230

CRITICAL

CVE-2025-10230

CWE-78Published: November 7, 2025· Updated: Jun 29, 2026

10.0

CVSS v3.1

Official Description

A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.

NVD Source

Risk Analysis

This critical vulnerability in Samba allows an unauthenticated network attacker to achieve remote command execution as the Samba process. The flaw stems from improper validation and escaping of NetBIOS names from WINS registration packets, which are passed to a shell. With a perfect CVSS score of 10.0, this is an extremely urgent vulnerability that could lead to complete system compromise.

No public exploit is currently known for this vulnerability. The flaw is remotely exploitable with low attack complexity, requiring no authentication.

Recommended Action

Administrators should apply security patches for Samba immediately. Ensure that Samba Active Directory Domain Controllers are properly configured and secured, and consider restricting WINS traffic to trusted sources.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2025-10230 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 10.0.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.