VulnRadar

Data against noise.

Page generated: 07 Nov 2026, 05:40 UTC

CVE-2014-7169

Read full description

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

CVSS 9.8 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

9.0/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 9.8: +1.47
Fresh EPSS: 99.94%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 9 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Field Effect

Press · 07 Oct 2025, 07:00 · Legacy vulnerabilities remain prime targets of exploitation - Field Effect

Cyber Daily

Press · 03 Oct 2025, 07:00 · Another 5 vulnerabilities added to CISA’s KEV catalogue - Cyber Daily

Cisco Blogs

Press · 13 Jun 2023, 07:00 · Threat Trends: Snort IPS - Cisco Blogs

Bitdefender

Press · 06 Jul 2016, 07:00 · ShellShock Roundup: What to do if You are Vulnerable - Bitdefender

TechTarget

Press · 13 Jan 2015, 08:00 · Lessons learned: Network security implications of Shellshock - TechTarget

See all 9 source documents

Cisco Blogs

Press · 21 Oct 2014, 07:00 · Nexus 9000/7000 Series Switches No Longer Vulnerable to Shellshock Bug - Cisco Blogs

Kaspersky

Press · 30 Sep 2014, 07:00 · Shellshock: how to check and update potentially vulnerable systems - Kaspersky

iTnews

Press · 29 Sep 2014, 07:00 · Further flaws render Shellshock patch ineffective - iTnews

Qualys

Press · 25 Sep 2014, 07:00 · Qualys QID 13038: Remote Detection for BASH ShellShock - Qualys

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 9.0 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

See 1 repos with metrics

Repository	Stars	Forks	Language	Updated
Kushiro45/shellshock-poc-cve-2014-7169	0	0	Dockerfile	14 Jul 2026, 03:58

Public exploit evidence

exploitdb #34765 2014-09-25
exploitdb #34766 2014-09-25
exploitdb #34777 2014-09-25
exploitdb #34839 2014-10-01
exploitdb #34860 2014-10-02
exploitdb #34862 2014-10-02
exploitdb #34879 2014-10-04
exploitdb #34895 2014-10-06
exploitdb #34896 2014-10-06
exploitdb #35115 2014-10-29
exploitdb #35146 2014-11-03
exploitdb #36503 2015-03-26
exploitdb #36504 2015-03-26
exploitdb #36609 2015-04-02
exploitdb #36933 2014-09-29

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 9.8; EPSS 99.9%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:57:37.491712+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Published

25 Sep 2014, 01:00

First press mention

25 Sep 2014, 07:00

Added to the CISA KEV catalog

28 Jan 2022, 00:00

Latest press mention

07 Oct 2025, 07:00

Score calculated

05 Nov 2026, 13:57

PoCs on GitHub

15 repositories