CVE-2014-6277 Official NVD Security Advisory (CVSS 10)
Executive & SecOps Summary
SECOPS ASSESSMENTImpacted configurations listed under CVE-2014-6277
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote att...
Review official patches and verify network isolation controls.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUNDApply the latest security updates provided by the official software maintainers.
Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
Official NVD Technical Description
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
- CVSS Score: 10 (HIGH)
- CWE IDs: CWE-78
Official Vendor Advisories & References
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
Frequently Asked SecOps Questions (CVE-2014-6277)
FAQQ1. How critical is CVE-2014-6277 and is it actively exploited in the wild?
CVE-2014-6277 is rated CVSS 10.0 (HIGH) with a 30-day EPSS exploitation probability of 64.3%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2014-6277?
Primary impacted vendors include security-advisory across software. Scope summary: Refer to official NVD CPE configuration entries
Q3. What temporary mitigations or workarounds exist for CVE-2014-6277 before patching?
[Mitigation] Review official patches and verify network isolation controls. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2014-6277
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (security-advisory)
View Category →CVE-2026-120114 Technical Vulnerability Analysis & Patch Advisory (CVSS 7.2)
[Affected Scope] Systems running unpatched versions impacted by CVE-2026-120114
LiteLLM Proxy Server MCP Test Endpoints Remote Code Execution Vulnerability Advisory (CVE-2026-42271)
[Affected Scope] LiteLLM proxy server environments running versions 1.74.2 to before 1.83.7
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Critical RCE in Nextcloud Collabora Online Built-in CODE Server (CVE-2026-110447)
[Affected Scope] Collabora Online Built-in CODE Server (richdocumentscode) for Nextcloud before version 26.4.303.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.