CVE-2014-6278
GNU Bash OS Command Injection Vulnerability
8.8
CVSS 3.1
99.6 %
EPSS (current)
2025-10-02
KEV addition
No
Ransomware
Timeline
Publication, first public exploit and KEV addition on a day axis.
Key facts
Vendor / product: GNU / GNU Bash
Published: 2014-09-30 · Due (CISA): 2025-10-23
CWE: CWE-78 · EU list: no
Exploit references (metadata only)
| Source | Reference | Title | Date |
|---|---|---|---|
| metasploit | auxiliary/scanner/http/apache_mod_cgi_bash_env | auxiliary/scanner/http/apache_mod_cgi_bash_env | 2014-09-24 |
| metasploit | exploit/multi/http/apache_mod_cgi_bash_env_exec | exploit/multi/http/apache_mod_cgi_bash_env_exec | 2014-09-24 |
| metasploit | exploit/multi/http/cups_bash_env_exec | exploit/multi/http/cups_bash_env_exec | 2014-09-24 |
| exploitdb | 36933 | dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock) | 2014-09-29 |
| exploitdb | 34860 | GNU bash 4.3.11 - Environment Variable dhclient | 2014-10-02 |
| exploitdb | 34900 | Apache mod_cgi - 'Shellshock' Remote Command Injection | 2014-10-06 |
| exploitdb | 39568 | Cisco UCS Manager 2.1(1b) - Remote Command Injection (Shellshock) | 2016-03-16 |
| exploitdb | 39887 | Sun Secure Global Desktop and Oracle Global Desktop 4.61.915 - Command Injection (Shellshock) | 2016-06-06 |
References only — no downloads or instructions.