SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityAnalyzed

CVE-2014-6278

GNU Bash OS Command Injection Vulnerability

KEVEXPLOIT ×5 ✓HIGH 8.8EPSS 99.7%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 23 October 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.

CVSS 3.1
8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
99.67% probability · 100th percentile
Public exploits
5 in Exploit-DB · verified · first 29 September 2014
CISA KEV
Listed 2 October 2025 · due 23 October 2025
Weakness
CWE-78
Affected
gnu/bash
Source
security@debian.org
EPSS trend
0%50%100%30 October 2026: 99.67%30 October 202630 October 2026

EPSS 99.7% since 30 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

CISA notes

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027 ; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23467 ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash ; https://www.ibm.com/support/pages/security-bulletin-update-vulnerabilities-bash-affect-aix-toolbox-linux-applications-cve-2014-6271-cve-2014-6277-cve-2014-6278-cve-2014-7169-cve-2014-7186-and-cve-2014-7187 ; https://nvd.nist.gov/vuln/detail/CVE-2014-6278

Public exploits (5)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-IDTitleTypePublishedVerified
EDB-39887source ↗Sun Secure Global Desktop and Oracle Global Desktop 4.61.915 - Command Injection (Shellshock)cgi · lastc0dewebapps6 June 2016no
EDB-39568source ↗Cisco UCS Manager 2.1(1b) - Remote Command Injection (Shellshock)hardware · thatchriseckertremote16 March 2016no
EDB-34900source ↗Apache mod_cgi - 'Shellshock' Remote Command Injectionlinux · Federico Galatoloremote6 October 2014yes
EDB-34860source ↗GNU bash 4.3.11 - Environment Variable dhclientlinux · @0x00stringremote2 October 2014no
EDB-36933source ↗dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)linux · fdiskyouremote29 September 2014yes

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.