CVE-2014-6278

GNU Bash, the standard command interpreter shipped with most Linux, Unix, and macOS systems, mishandles specially crafted environment variables, allowing attackers to inject and execute arbitrary OS commands (CVE-2014-6278 is one of the follow-on "Shellshock" parsing flaws disclosed in September 2014 alongside the original CVE-2014-6271). Exploitation requires a path where attacker-controlled data reaches Bash through the environment, classically via web CGI scripts, restricted or forced-command SSH configurations, DHCP clients, and other services that invoke the shell. A successful attack yields arbitrary command execution with the privileges of the invoking service, potentially leading to full system compromise. Any unpatched GNU Bash installation is affected, including Linux/Unix servers, macOS endpoints, and embedded or network appliances that bundle the shell. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-10-02, confirming exploitation in the wild, and EPSS assigns a 99.5% probability of exploitation within 30 days.

What to do: Upgrade Bash to your distribution's or vendor's current patched build (all major Linux distributions and Apple shipped fixes after the September 2014 disclosures) and verify installed package versions rather than assuming patch status. Prioritize remediation on internet-facing systems where Bash may run with attacker-controlled environment variables, such as web/CGI servers, SSH forced-command setups, and embedded appliances, and follow CISA BOD 22-01 mitigation guidance per the KEV listing, or discontinue use if patches are unavailable. Hunt for legacy or embedded images that never received the 2014-era patches, since those are the most likely remaining vulnerable instances.