CVE-2014-6278: GNU Bash environment function parsing command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with a near-maximum EPSS score and allows unauthenticated remote command execution, though the CVSS vector requires user interaction.

What it is

GNU Bash through 4.3 bash43-026 fails to properly parse function definitions in environment variable values, allowing command injection when the environment crosses a privilege boundary. It is an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277, so systems patched only for the earlier Shellshock flaws may still be exposed.

Impact

An attacker can execute arbitrary commands with the privileges of the process that invokes Bash, potentially leading to full host compromise. The CVSS 3.1 vector rates confidentiality, integrity, and availability impact as high.

Attack surface

Reachable remotely over the network (AV:N) with no privileges required (PR:N), but user interaction is required (UI:R) per the CVSS vector. The description cites OpenSSH ForceCommand, Apache mod_cgi/mod_cgid, and DHCP client scripts as paths where environment variables are set across a privilege boundary before Bash runs.

Exploitation

CISA added it to the KEV catalog on 2025-10-02 with a due date of 2025-10-23, and EPSS gives a 30-day probability of 0.9952 (99.9th percentile), indicating active exploitation is expected. No ransomware campaign use is documented in the record.

What to do

• Patch Bash to a version that fully addresses CVE-2014-6271, CVE-2014-7169, CVE-2014-6277, and CVE-2014-6278; apply vendor errata rather than the earlier partial fixes.
• Follow CISA KEV required action and BOD 22-01 guidance for cloud services, or discontinue use of the affected product if mitigations are unavailable.
• Reduce exposure by avoiding untrusted environment variables crossing privilege boundaries into Bash, and review CGI, SSH ForceCommand, and DHCP client script configurations.
• Where patching is delayed, restrict network access to services that pass environment data to Bash and monitor for anomalous child processes.

Detection

• Monitor for Bash processes spawned by web servers (mod_cgi/mod_cgid), sshd ForceCommand, or DHCP clients with unexpected command arguments or child processes.
• Alert on environment variables containing function-definition syntax such as '() {' passed into Bash invocations.
• Hunt for outbound connections or file writes originating from CGI, SSH, or DHCP service accounts shortly after request handling.
• Track Bash package versions across hosts and flag any still at or below 4.3 bash43-026.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.