CVE-2014-6271: GNU Bash environment variable command injection (ShellShock)

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV active exploitation, and near-maximum EPSS make this an urgent patch-first issue despite its age.

What it is

GNU Bash through 4.3 processes trailing strings after function definitions in environment variable values, allowing injected commands to run when Bash is invoked. This is the ShellShock flaw, and it matters because Bash is widely used and the vulnerable path crosses privilege boundaries in common services.

Impact

An attacker can execute arbitrary commands with the privileges of the process that invokes Bash, which can lead to full host compromise where that process is privileged. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reachable remotely over the network with no authentication and no user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The description names ForceCommand in OpenSSH sshd, Apache mod_cgi and mod_cgid, DHCP client scripts, and other cases where an environment is set across a privilege boundary before Bash runs.

Exploitation

CISA KEV lists it as actively exploited, added 2022-01-28, and EPSS is 0.99999 (99.993rd percentile). References include an Exploit-tagged link, and KEV notes no known ransomware campaign use.

What to do

• Patch Bash to a vendor-fixed version; note the original fix was incomplete and CVE-2014-7169 covers the residual issue, so apply the later corrected update.
• Apply vendor updates per CISA KEV instructions for all listed vendors and products, including appliances and storage systems that embed Bash.
• Where patching is delayed, avoid passing untrusted input into environment variables consumed by Bash, and restrict or disable CGI and other Bash-invoking interfaces exposed to untrusted networks.
• Reduce exposure of SSH ForceCommand and DHCP client script paths that set environment variables across a privilege boundary.

Detection

• Monitor process execution for Bash spawned by web servers (mod_cgi/mod_cgid), sshd ForceCommand, or DHCP client scripts with unexpected child processes.
• Inspect HTTP requests and other untrusted input for the '() { :;};' function-definition pattern characteristic of ShellShock payloads.
• Alert on environment variables containing function definitions followed by trailing commands reaching Bash-invoking services.
• Audit hosts and appliances for unpatched Bash versions, including embedded copies in network and storage devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.