ZeroDay Findings
Sign inSign up

Findings

CVE-2014-6278

GNU Bash OS Command Injection Vulnerability

Published Sep 30, 2014 · updated Jun 16, 2026 · CISA GNU Bash

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 30, 2014 · Catalog

    Detected

    GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other s

  2. Oct 2, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Oct 23, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other s

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Oct 23, 2025

Affected

  • cpe gnu/bash1.14.0
  • cpe gnu/bash1.14.1
  • cpe gnu/bash1.14.2
  • cpe gnu/bash1.14.3
  • cpe gnu/bash1.14.4
  • cpe gnu/bash1.14.5
  • cpe gnu/bash1.14.6
  • cpe gnu/bash1.14.7
  • vendor GNU GNU Bashversion unspecified

Sources

  • CISA Cybersecurity AdvisoriesGovernment advisoryCVE-2014-6278

    Advisory at a Glance Title Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data <div class="TableCellContent SCXW40

    cisa.gov
  • CISA KEVConfirmed exploitationCVE-2014-6278

    GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2014-6278

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2014-6278

    30-day exploitation probability 99.7%

    first.org
  • Exploit DatabasePublic exploit reference34900

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit DatabasePublic exploit reference39568

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Exploit DatabasePublic exploit reference39887

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit ModulesPublic exploit moduleauxiliary_scanner/http/apache_mod_cgi_bash_env

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit ModulesPublic exploit moduleexploit_multi/http/apache_mod_cgi_bash_env_exec

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit ModulesPublic exploit moduleexploit_multi/http/cups_bash_env_exec

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDVulnerability recordCVE-2014-6278

    GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH ssh

    nvd.nist.gov

References

CVE-2014-6278 · ZeroDay Findings