CVE-2014-6278

HIGH(8.8)KEVLikely Exploited

GNU Bash OS Command Injection Vulnerability

Description

CVE-2014-6278 is a high-severity OS command injection vulnerability in GNU Bash through version 4.3 (bash43-026), part of the notorious Shellshock family of vulnerabilities. The flaw allows remote attackers to execute arbitrary commands through crafted environment variables due to improper parsing of function definitions. This vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277, and can be exploited through various attack vectors including OpenSSH sshd's ForceCommand, Apache HTTP Server's mod_cgi and mod_cgid modules, and DHCP client scripts. With a CVSS v3.1 base score of 8.8 and an EPSS score of 89.74% at the 99th percentile, CVE-2014-6278 remains one of the most actively exploited vulnerabilities in history.

KEV Information

Vendor
GNU
Product
GNU Bash
Date Added
October 2, 2025
Due Date
October 23, 2025
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
2.8
Impact Score
5.9

CWEs

CWE-78OS Command Injection

Improper Neutralization of Special Elements used in an OS Command

Affected Products

VendorProductVersion
gnubash1.14.0; 1.14.1; 1.14.2; 1.14.3; 1.14.4; 1.14.5; 1.14.6; 1.14.7; 2.0; 2.01; 2.01.1; 2.02; 2.02.1; 2.03; 2.04; 2.05; 3.0; 3.0.16; 3.1; 3.2; 3.2.48; 4.0; 4.1; 4.2; 4.3

References

Weakness Type

CWE-78: OS Command Injection

CVE-2014-6278 is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS command injection. In GNU Bash, the shell's environment variable processing mechanism fails to properly parse and restrict function definitions embedded in environment variable values. This allows attackers to inject arbitrary OS commands that execute when Bash processes the crafted environment variable, effectively turning any system component that passes environment variables through Bash into an attack vector.

Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Impact Analysis

CVE-2014-6278 presents a severe security impact due to the ubiquity of GNU Bash across Unix-like systems. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L) and no authentication required (PR:N), though user interaction is required (UI:R) in certain exploitation scenarios such as visiting a malicious DHCP-enabled network. Confidentiality (High): Successful exploitation grants the attacker command execution capabilities, enabling access to any data readable by the exploited process, including configuration files, database credentials, and sensitive application data. Integrity (High): An attacker can modify files, install backdoors, alter system configurations, and tamper with application data. Availability (High): The attacker can terminate services, consume system resources, or destroy data. With a CVSS score of 8.8 (High) and the Shellshock vulnerability affecting millions of systems running GNU Bash on web servers, network devices, IoT systems, and embedded platforms, the potential blast radius is enormous. The EPSS score of 89.74% confirms that exploitation remains near-certain for exposed systems.

Exploit Maturity

CVE-2014-6278 exhibits maximum exploit maturity as part of the Shellshock vulnerability family. Public exploit code is available through multiple sources, including Exploit-DB entry 39568 and Exploit-DB entry 39887. CISA has confirmed active exploitation by adding this vulnerability to the Known Exploited Vulnerabilities catalog. The EPSS score of 89.74% at the 99th percentile indicates near-certain exploitation activity. As a Shellshock variant (an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277), this vulnerability has been widely exploited since its disclosure in 2014 across web servers, CGI applications, SSH environments, and DHCP clients. Automated exploitation tools and worm-like malware targeting Shellshock variants have been observed globally, affecting systems from enterprise web servers to consumer IoT devices.

Remediation

  1. Upgrade GNU Bash to version 4.3 patch 27 or later (or the latest available version for your distribution). The CISA required action states to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. All GNU Bash versions from 1.14.0 through 4.3 are affected.

  2. Apply distribution-specific patches. Major Linux distributions (Red Hat, Debian, Ubuntu, SUSE, Fedora) and other Unix-like operating systems have released patched Bash packages. Verify that all systems, including servers, containers, embedded devices, and network appliances, are running patched versions.

  3. Restrict exposure of vulnerable attack surfaces as an interim mitigation. If Bash cannot be immediately updated, disable mod_cgi and mod_cgid in Apache HTTP Server where not needed, restrict SSH ForceCommand configurations, and limit DHCP client script execution. Implement WAF rules to detect and block Shellshock exploitation attempts in HTTP headers.

  4. Audit all systems for compromise. Review web server access logs for Shellshock exploitation patterns (crafted User-Agent, Referer, or other HTTP headers containing Bash function definitions). Check for unauthorized processes, new user accounts, modified cron jobs, and unexpected network connections.

  5. Implement defense in depth. Deploy intrusion detection systems with Shellshock signatures, segment networks to limit lateral movement, and maintain an inventory of all systems running Bash to ensure comprehensive patching across the environment.

Technical Details

CVE-2014-6278 is an OS command injection vulnerability in GNU Bash's environment variable parsing logic. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a network-exploitable flaw requiring no privileges but some form of user interaction, with high impact across all CIA dimensions. The vulnerability stems from incomplete remediation of the original Shellshock flaw (CVE-2014-6271). When Bash processes environment variables, it evaluates function definitions encoded as variable values. The patch for CVE-2014-6271 and CVE-2014-7169 was insufficient, as CVE-2014-6278 demonstrates that attackers can still craft environment variable values that bypass the updated parser and inject arbitrary commands. The attack surface is broad: any scenario where an attacker can set environment variables that are subsequently processed by Bash is exploitable, including CGI scripts where HTTP headers become environment variables, SSH sessions using ForceCommand, DHCP clients executing configuration scripts, and other privilege boundary crossings. This makes the Shellshock family particularly dangerous, as Bash is the default shell on most Linux and macOS systems.

Frequently Asked Questions

Is CVE-2014-6278 being actively exploited?

Yes. CVE-2014-6278 has been actively exploited since its disclosure in 2014 as part of the Shellshock vulnerability family. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 89.74% at the 99th percentile confirms ongoing widespread exploitation activity.

What products are affected by CVE-2014-6278?

GNU Bash versions 1.14.0 through 4.3 (bash43-026) are affected. Since Bash is the default shell on most Linux distributions and macOS, virtually every Unix-like system running an unpatched Bash version is vulnerable. Exploitation vectors include Apache HTTP Server with CGI, OpenSSH with ForceCommand, and various DHCP client implementations.

How do I fix CVE-2014-6278?

Upgrade GNU Bash to version 4.3 patch 27 or later. Apply the latest Bash package from your operating system distribution. If immediate patching is not possible, disable Apache CGI modules, restrict SSH ForceCommand configurations, and deploy WAF rules to block Shellshock exploitation patterns.

How severe is CVE-2014-6278?

CVE-2014-6278 is rated High with a CVSS v3.1 base score of 8.8. As a Shellshock variant, it allows remote code execution through crafted environment variables across numerous attack vectors. Its EPSS score of 89.74% at the 99th percentile reflects its status as one of the most exploited vulnerabilities in computing history.

CVSS Score

8.8
HIGH(8.8)

EPSS Score

EPSS Score99.62%
EPSS Percentile99.9%

Dates

PublishedSeptember 30, 2014
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch