Critical Samba Flaw Allows Remote Attackers to Execute Arbitrary Code

A newly disclosed vulnerability in Samba’s WINS server hook script allows unauthenticated attackers to execute arbitrary commands on affected domain controllers. The flaw, tracked as CVE-2025-10230, has a maximum CVSSv3.1 score of 10.0, reflecting its ease of exploitation and potential impact on confidentiality, integrity and availability.

It affects all Samba versions from 4.0 onward when running as an Active Directory Domain Controller with WINS support, with the risk arising because the WINS server passes names directly into a shell command. Patches have been released for Samba 4.23.2, 4.22.5 and 4.21.9; administrators should upgrade or apply the official patch, and as a workaround, remove or disable the wins hook parameter by setting wins hook = in smb.conf, or disable WINS support entirely (wins support = no).

The article notes that remote attackers do not need credentials and no user interaction is required beyond a specially crafted WINS request, making urgent action prudent to protect directory services and the broader network. according to Samba.