VulnRadar

Data against noise.

Built with NaN
Page generated: 08 Nov 2026, 13:35 UTC
← Dashboard

CVE-2014-6278

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH ssh…

Read full description
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
CVSS 8.8 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
2.6/10
REALITY · THREAT PRIORITY
8.8/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 8.8: +1.32
  • Fresh EPSS: 99.67%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 11 documents and public datasets.

Hype components

Headline sample (25%)
70/100
Press, 30 days (60%)
15/100
Grounded branding (15%)
0/100
HYPE TOTAL26/100

Sources and documents

Tech Times
Press · 09 Oct 2026, 07:00 · Beijing Firm Integrity Technology Group Hacked Government Email, Built Third-Party Portal - Tech Times
The Hacker News
Press · 09 Oct 2026, 07:00 · Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies - The Hacker News
The Hacker News
Press · 08 Oct 2026, 07:00 · FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails - The Hacker News
Field Effect
Press · 07 Oct 2025, 07:00 · Legacy vulnerabilities remain prime targets of exploitation - Field Effect
Cyber Daily
Press · 03 Oct 2025, 07:00 · Another 5 vulnerabilities added to CISA’s KEV catalogue - Cyber Daily
See all 11 source documents
The Hacker News
Press · 03 Oct 2025, 07:00 · CISA Flags Meteobridge CVE-2025-4008 Flaw as Actively Exploited in the Wild - The Hacker News
SecurityWeek
Press · 03 Oct 2025, 07:00 · Organizations Warned of Exploited Meteobridge Vulnerability - SecurityWeek
Cisco Blogs
Press · 13 Jun 2023, 07:00 · Threat Trends: Snort IPS - Cisco Blogs
Cisco Blogs
Press · 21 Oct 2014, 07:00 · Nexus 9000/7000 Series Switches No Longer Vulnerable to Shellshock Bug - Cisco Blogs
iTnews
Press · 29 Sep 2014, 07:00 · Further flaws render Shellshock patch ineffective - iTnews
Qualys
Press · 25 Sep 2014, 07:00 · Qualys QID 13038: Remote Detection for BASH ShellShock - Qualys

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 2.6 · reality 8.8 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

5

Public exploit entries / repo candidates

Source entries and unverified repository candidates are counted separately.

Public exploit evidence
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 8.8; EPSS 99.7%
Attention, last 30 days
2 distinct story titles; 2 press documents; 1 publisher domains.
Technical potential
network access, no prior privileges, user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:57:36.494009+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
25 Sep 2014, 07:00
Published
30 Sep 2014, 10:00
Added to the CISA KEV catalog
02 Oct 2025, 00:00
Latest press mention
09 Oct 2026, 07:00
Score calculated
05 Nov 2026, 13:57
PoCs on GitHub
5 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar