November 15, 2026

CVE Watchtower

CVE-2014-7169Gnu Bash

NVDCVSS scored by NVD (NIST)

Vulnerability Summary

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
Severity Level
CRITICAL(9.8)
Published Date
Sep 25, 2014
Last Modified
Apr 22, 2026
Exploitation Status
ACTIVE
EPSS Score (30-Day)
89.06%Probability
Root Weakness (CWE)
N/A
CVSS v3.1 Base Metrics — Score 9.8 (CRITICAL)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

Affected & Patched Versions

Affected Versions
  • Gnu Bash <= 4.3
  • Arista Eos >= 4.9.0 and < 4.9.12
  • Arista Eos >= 4.10.0 and < 4.10.9
  • Arista Eos >= 4.11.0 and < 4.11.11
  • Arista Eos >= 4.12.0 and < 4.12.9
  • Arista Eos >= 4.13.0 and < 4.13.9
  • Arista Eos >= 4.14.0 and < 4.14.4f
  • Oracle Linux
  • Qnap Qts < 4.1.1
  • Qnap Qts
  • Mageia Mageia
  • Redhat Gluster Storage Server For On-premise
  • Redhat Virtualization
  • Redhat Enterprise Linux
  • Redhat Enterprise Linux Desktop
  • Redhat Enterprise Linux Eus
  • Redhat Enterprise Linux For Ibm Z Systems
  • Redhat Enterprise Linux For Power Big Endian
  • Redhat Enterprise Linux For Power Big Endian Eus
  • Redhat Enterprise Linux For Scientific Computing
  • Redhat Enterprise Linux Server
  • Redhat Enterprise Linux Server Aus
  • Redhat Enterprise Linux Server From Rhui
  • Redhat Enterprise Linux Server Tus
  • Redhat Enterprise Linux Workstation
  • Suse Studio Onsite
  • Opensuse Opensuse
  • Suse Linux Enterprise Desktop
  • Suse Linux Enterprise Server
  • Suse Linux Enterprise Software Development Kit
  • Debian Debian Linux
  • Ibm Infosphere Guardium Database Activity Monitoring
  • Ibm Pureapplication System >= 1.0.0.0 and <= 1.0.0.4
  • Ibm Pureapplication System >= 1.1.0.0 and <= 1.1.0.4
  • Ibm Pureapplication System
  • Ibm Qradar Risk Manager
  • Ibm Qradar Security Information And Event Manager
  • Ibm Qradar Vulnerability Manager
  • Ibm Smartcloud Entry Appliance
  • Ibm Smartcloud Provisioning
  • Ibm Software Defined Network For Virtual Environments < 1.2.1
  • Ibm Starter Kit For Cloud
  • Ibm Workload Deployer >= 3.1.0 and <= 3.1.0.7
  • Ibm Security Access Manager For Mobile 8.0 Firmware
  • Ibm Security Access Manager For Web 7.0 Firmware
  • Ibm Security Access Manager For Web 8.0 Firmware
  • Ibm Storwize V7000 Firmware >= 1.1.0.0 and < 1.4.3.5
  • Ibm Storwize V7000 Firmware >= 1.5.0.0 and < 1.5.0.4
  • Ibm Storwize V7000 Firmware >= 7.2.0.0 and < 7.2.0.9
  • Ibm Storwize V7000 Firmware >= 7.3.0.0 and < 7.3.0.7
  • Ibm Storwize V5000 Firmware >= 1.1.0.0 and < 7.1.0.11
  • Ibm Storwize V5000 Firmware >= 7.2.0.0 and < 7.2.0.9
  • Ibm Storwize V5000 Firmware >= 7.3.0.0 and < 7.3.0.7
  • Ibm Storwize V3700 Firmware >= 1.1.0.0 and < 7.1.0.11
  • Ibm Storwize V3700 Firmware >= 7.2.0.0 and < 7.2.0.9
  • Ibm Storwize V3700 Firmware >= 7.3.0.0 and < 7.3.0.7
  • Ibm Storwize V3500 Firmware >= 1.1.0.0 and < 7.1.0.11
  • Ibm Storwize V3500 Firmware >= 7.2.0.0 and < 7.2.0.9
  • Ibm Storwize V3500 Firmware >= 7.3.0.0 and < 7.3.0.7
  • Ibm Flex System V7000 Firmware >= 1.1.0.0 and < 7.1.0.11
  • Ibm Flex System V7000 Firmware >= 7.2.0.0 and < 7.2.0.9
  • Ibm Flex System V7000 Firmware >= 7.3.0.0 and < 7.3.0.7
  • Ibm San Volume Controller Firmware >= 1.1.0.0 and < 7.1.0.11
  • Ibm San Volume Controller Firmware >= 7.2.0.0 and < 7.2.0.9
  • Ibm San Volume Controller Firmware >= 7.3.0.0 and < 7.3.0.7
  • Ibm Stn6500 Firmware >= 3.8.0.0 and < 3.8.0.07
  • Ibm Stn6500 Firmware >= 3.9.1.0 and < 3.9.1.08
  • Ibm Stn6500 Firmware >= 4.1.2.0 and < 4.1.2.06
  • Ibm Stn6800 Firmware >= 3.8.0.0 and < 3.8.0.07
  • Ibm Stn6800 Firmware >= 3.9.1.0 and < 3.9.1.08
  • Ibm Stn6800 Firmware >= 4.1.2.0 and < 4.1.2.06
  • Ibm Stn7800 Firmware >= 3.8.0.0 and < 3.8.0.07
  • Ibm Stn7800 Firmware >= 3.9.1.0 and < 3.9.1.08
  • Ibm Stn7800 Firmware >= 4.1.2.0 and < 4.1.2.06
  • Canonical Ubuntu Linux
  • Novell Zenworks Configuration Management
  • Novell Open Enterprise Server
  • Checkpoint Security Gateway < r77.30
  • F5 Big-ip Access Policy Manager >= 10.1.0 and <= 10.2.4
  • F5 Big-ip Access Policy Manager >= 11.0.0 and <= 11.5.1
  • F5 Big-ip Access Policy Manager
  • F5 Big-ip Advanced Firewall Manager >= 11.3.0 and <= 11.5.1
  • F5 Big-ip Advanced Firewall Manager
  • F5 Big-ip Analytics >= 11.0.0 and <= 11.5.1
  • F5 Big-ip Analytics
  • F5 Big-ip Application Acceleration Manager >= 11.4.0 and <= 11.5.1
  • F5 Big-ip Application Acceleration Manager
  • F5 Big-ip Application Security Manager >= 10.0.0 and <= 10.2.4
  • F5 Big-ip Application Security Manager >= 11.0.0 and <= 11.5.1
  • F5 Big-ip Application Security Manager
  • F5 Big-ip Edge Gateway >= 10.1.0 and <= 10.2.4
  • F5 Big-ip Edge Gateway >= 11.0.0 and <= 11.3.0
  • F5 Big-ip Global Traffic Manager >= 10.0.0 and <= 10.2.4
  • F5 Big-ip Global Traffic Manager >= 11.0.0 and <= 11.5.1
  • F5 Big-ip Global Traffic Manager
  • F5 Big-ip Link Controller >= 10.0.0 and <= 10.2.4
  • F5 Big-ip Link Controller >= 11.0.0 and <= 11.5.1
  • F5 Big-ip Link Controller
  • F5 Big-ip Local Traffic Manager >= 10.0.0 and <= 10.2.4
  • F5 Big-ip Local Traffic Manager >= 11.0.0 and <= 11.5.1
  • F5 Big-ip Local Traffic Manager
  • F5 Big-ip Policy Enforcement Manager >= 11.3.0 and <= 11.5.1
  • F5 Big-ip Policy Enforcement Manager
  • F5 Big-ip Protocol Security Module >= 10.0.0 and <= 10.2.4
  • F5 Big-ip Protocol Security Module >= 11.0.0 and <= 11.4.1
  • F5 Big-ip Wan Optimization Manager >= 10.0.0 and <= 10.2.4
  • F5 Big-ip Wan Optimization Manager >= 11.0.0 and <= 11.3.0
  • F5 Big-ip Webaccelerator >= 10.0.0 and <= 10.2.4
  • F5 Big-ip Webaccelerator >= 11.0.0 and <= 11.3.0
  • F5 Big-iq Cloud >= 4.0.0 and <= 4.4.0
  • F5 Big-iq Device >= 4.2.0 and <= 4.4.0
  • F5 Big-iq Security >= 4.0.0 and <= 4.4.0
  • F5 Enterprise Manager >= 2.1.0 and <= 2.3.0
  • F5 Enterprise Manager >= 3.0.0 and <= 3.1.1
  • F5 Traffix Signaling Delivery Controller >= 4.0.0 and <= 4.0.5
  • F5 Traffix Signaling Delivery Controller
  • F5 Arx Firmware >= 6.0.0 and <= 6.4.0
  • Citrix Netscaler Sdx Firmware < 9.3.67.5r1
  • Citrix Netscaler Sdx Firmware >= 10 and < 10.1.129.11r1
  • Citrix Netscaler Sdx Firmware >= 10.5 and < 10.5.52.11r1
  • Apple Mac Os X >= 10.0.0 and < 10.10.0
  • Vmware Vcenter Server Appliance
  • Vmware Esx
Patched Versions
  • Arista Eos 4.9.12
  • Arista Eos 4.10.9
  • Arista Eos 4.11.11
  • Arista Eos 4.12.9
  • Arista Eos 4.13.9
  • Arista Eos 4.14.4f
  • Qnap Qts 4.1.1
  • Ibm Software Defined Network For Virtual Environments 1.2.1
  • Ibm Storwize V7000 Firmware 1.4.3.5
  • Ibm Storwize V7000 Firmware 1.5.0.4
  • Ibm Storwize V7000 Firmware 7.2.0.9
  • Ibm Storwize V7000 Firmware 7.3.0.7
  • Ibm Storwize V5000 Firmware 7.1.0.11
  • Ibm Storwize V5000 Firmware 7.2.0.9
  • Ibm Storwize V5000 Firmware 7.3.0.7
  • Ibm Storwize V3700 Firmware 7.1.0.11
  • Ibm Storwize V3700 Firmware 7.2.0.9
  • Ibm Storwize V3700 Firmware 7.3.0.7
  • Ibm Storwize V3500 Firmware 7.1.0.11
  • Ibm Storwize V3500 Firmware 7.2.0.9
  • Ibm Storwize V3500 Firmware 7.3.0.7
  • Ibm Flex System V7000 Firmware 7.1.0.11
  • Ibm Flex System V7000 Firmware 7.2.0.9
  • Ibm Flex System V7000 Firmware 7.3.0.7
  • Ibm San Volume Controller Firmware 7.1.0.11
  • Ibm San Volume Controller Firmware 7.2.0.9
  • Ibm San Volume Controller Firmware 7.3.0.7
  • Ibm Stn6500 Firmware 3.8.0.07
  • Ibm Stn6500 Firmware 3.9.1.08
  • Ibm Stn6500 Firmware 4.1.2.06
  • Ibm Stn6800 Firmware 3.8.0.07
  • Ibm Stn6800 Firmware 3.9.1.08
  • Ibm Stn6800 Firmware 4.1.2.06
  • Ibm Stn7800 Firmware 3.8.0.07
  • Ibm Stn7800 Firmware 3.9.1.08
  • Ibm Stn7800 Firmware 4.1.2.06
  • Checkpoint Security Gateway r77.30
  • Citrix Netscaler Sdx Firmware 9.3.67.5r1
  • Citrix Netscaler Sdx Firmware 10.1.129.11r1
  • Citrix Netscaler Sdx Firmware 10.5.52.11r1
  • Apple Mac Os X 10.10.0

What to do

Patch now. CISA lists this flaw as exploited in the wild and set a federal remediation deadline of Jul 28, 2022.

  1. Check whether you run Gnu Bash and which version.
  2. Update to a patched version listed above, then confirm the new version.
  3. Review logs and exposed services for signs of earlier compromise.

CISA required action: Apply updates per vendor instructions.

CISA KEV Status

Listed in Known Exploited Vulnerabilities
Added: Jan 28, 2022
Remediation due: Jul 28, 2022 (deadline passed)

Timeline

  • Sep 25, 2014Published
  • Jan 28, 2022Added to CISA KEV catalog
  • Jul 28, 2022KEV remediation due date
  • Apr 22, 2026Record last modified

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new Gnu Bash CVEsYou are reading CVE-2014-7169. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alerts

More Gnu Bash CVEs

External References

Data last checked: Nov 15, 2026 00:23 UTC