erroneo.us
Search all guides⌘K

Security Digest · Vulnerability record · Known exploited

CVE-2014-6278: GNU Bash OS Command Injection Vulnerability

Exploited in the wild (CISA KEV). GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd…

CISA KEV · added 2025-10-02 CVSS 8.8 High EPSS 99.6% · p99.9

Updated By erroneo.us Security Desk117 references Seen in the digest for Oct 2, 2025

Should you act?

Exploited: patch now if you run it

CISA has confirmed exploitation in the wild. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

  • Yes, if you run GNU GNU Bash. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2025-10-02, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2025-10-23; treat that as the outer limit, not the target.
  • EPSS 99.6%, percentile 99.9: FIRST’s model estimates a 99.6% chance of exploitation activity in the next 30 days, higher than 99.9% of all scored CVEs (very high). EPSS is a probability, not a verdict.
  • Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.

What it is

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the modcgi and modcgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.

CISA’s summary

GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.

Weakness type: CWE-78.

Product: GNU GNU Bash · Assigned by: debian · Published: 2014-09-30

Affected and fixed versions

VendorProductAffected versions (per CVE record)
n/an/asee vendor advisory

Severity scores

Scored byCVSSScoreVector
CISA-ADP3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • Attack vector: network (remotely reachable)
  • Attack complexity: low
  • Privileges required: none (no login)
  • User interaction: required (a user must click/open something)
  • Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

  • CISA KEV: added 2025-10-02; federal due date 2025-10-23. Known ransomware use: Unknown.
  • CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
  • CISA SSVC assessment: exploitation active, automatable no, technical impact total.
  • FIRST EPSS (model of 2026-10-21): 99.59% probability of exploitation activity in the next 30 days; percentile 99.9.

Timeline

  • — CVE record published by debian
  • — Added to CISA’s Known Exploited Vulnerabilities catalog
  • — CISA remediation deadline for US federal agencies
  • — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vendor and project advisories, patches

  1. HPSBMU03165 marc.info
  2. SSRT101819 marc.info
  3. HPSBMU03245 marc.info
  4. HPSBMU03143 marc.info
  5. HPSBMU03182 marc.info
  6. HPSBST03155 marc.info
  7. openSUSE-SU-2014:1310 lists.opensuse.org
  8. HPSBMU03246 marc.info
  9. USN-2380-1 ubuntu.com
  10. HPSBMU03217 marc.info
  11. SSRT101868 marc.info
  12. HPSBST03129 marc.info
  13. HPSBMU03144 marc.info
  14. SUSE-SU-2014:1287 lists.opensuse.org
  15. MDVSA-2015:164 mandriva.com
  16. 20140926 GNU Bash Environment Variable Command Injection Vulnerability tools.cisco.com
  17. HPSBST03157 marc.info
  18. HPSBST03154 marc.info
  19. HPSBGN03142 marc.info
  20. HPSBST03181 marc.info
  21. HPSBHF03145 marc.info
  22. HPSBGN03138 marc.info
  23. HPSBHF03125 marc.info
  24. HPSBHF03146 marc.info
  25. HPSBGN03141 marc.info
  26. Listed in CISA KEV notes (ftp.gnu.org) ftp.gnu.org
  27. Listed in CISA KEV notes (support.broadcom.com) support.broadcom.com
  28. Listed in CISA KEV notes (sec.cloudapps.cisco.com) sec.cloudapps.cisco.com
  29. Listed in CISA KEV notes (ibm.com) ibm.com

Vulnerability records

  1. CVE.org record CVE-2014-6278 cve.org
  2. NVD entry CVE-2014-6278 nvd.nist.gov

Government

  1. CISA Known Exploited Vulnerabilities catalog entry cisa.gov

Other references from the CVE record and advisory

  1. www-01.ibm.com www-01.ibm.com
  2. www-01.ibm.com www-01.ibm.com
  3. supportcenter.checkpoint.com supportcenter.checkpoint.com
  4. linux.oracle.com linux.oracle.com
  5. www-01.ibm.com www-01.ibm.com
  6. JVN#55667175 jvn.jp
  7. 60433 secunia.com
  8. packetstormsecurity.com packetstormsecurity.com
  9. www-01.ibm.com www-01.ibm.com
  10. oracle.com oracle.com
  11. 61816 secunia.com
  12. 61442 secunia.com
  13. 61283 secunia.com
  14. kc.mcafee.com kc.mcafee.com
  15. 61654 secunia.com
  16. www-947.ibm.com www-947.ibm.com
  17. 62312 secunia.com
  18. support.f5.com support.f5.com
  19. security-tracker.debian.org security-tracker.debian.org
  20. www-01.ibm.com www-01.ibm.com
  21. 61703 secunia.com
  22. 61065 secunia.com
  23. www-01.ibm.com www-01.ibm.com
  24. www-01.ibm.com www-01.ibm.com
  25. JVNDB-2014-000126 jvndb.jvn.jp
  26. 61641 secunia.com
  27. 39887 exploit-db.com
  28. kb.juniper.net kb.juniper.net
  29. www-01.ibm.com www-01.ibm.com
  30. www-01.ibm.com www-01.ibm.com
  31. support.hpe.com support.hpe.com
  32. 60325 secunia.com
  33. 60024 secunia.com
  34. packetstormsecurity.com packetstormsecurity.com
  35. lcamtuf.blogspot.com lcamtuf.blogspot.com
  36. bugzilla.redhat.com bugzilla.redhat.com
  37. 62343 secunia.com
  38. 61565 secunia.com
  39. suse.com suse.com
  40. 61313 secunia.com
  41. 61485 secunia.com
  42. support.hpe.com support.hpe.com
  43. www-01.ibm.com www-01.ibm.com
  44. 61312 secunia.com
  45. linux.oracle.com linux.oracle.com
  46. 60193 secunia.com
  47. vmware.com vmware.com
  48. 60063 secunia.com
  49. 60034 secunia.com
  50. 59907 secunia.com
  51. 58200 secunia.com
  52. 61643 secunia.com
  53. novell.com novell.com
  54. www-01.ibm.com www-01.ibm.com
  55. 61503 secunia.com
  56. www-01.ibm.com www-01.ibm.com
  57. www-01.ibm.com www-01.ibm.com
  58. support.novell.com support.novell.com
  59. qnap.com qnap.com
  60. 61552 secunia.com
  61. 61780 secunia.com
  62. www-01.ibm.com www-01.ibm.com
  63. support.citrix.com support.citrix.com
  64. 39568 exploit-db.com
  65. 60044 secunia.com
  66. 61291 secunia.com
  67. 61287 secunia.com
  68. www-01.ibm.com www-01.ibm.com
  69. 61128 secunia.com
  70. support.citrix.com support.citrix.com
  71. 61471 secunia.com
  72. 60055 secunia.com
  73. 59961 secunia.com
  74. 61550 secunia.com
  75. 61633 secunia.com
  76. lcamtuf.blogspot.com lcamtuf.blogspot.com
  77. www-01.ibm.com www-01.ibm.com
  78. kb.bluecoat.com kb.bluecoat.com
  79. 61328 secunia.com
  80. www-01.ibm.com www-01.ibm.com
  81. 61129 secunia.com
  82. 61603 secunia.com
  83. 61857 secunia.com
  84. www-01.ibm.com www-01.ibm.com
  85. arista.com arista.com

All exploited GNU vulnerabilities · Today’s Security Digest