Two GNU project components — Bash and InetUtils — each had a vulnerability confirmed under active exploitation and added to CISA's Known Exploited Vulnerabilities catalogue in the same window, despite one flaw being over a decade old at the time of listing. Both are foundational, widely-embedded Unix-family software rather than end-user applications, and both bypass authentication or execute commands through environment-variable handling.
| CVE | CVSS | Component | Originally Disclosed | Added to KEV |
|---|---|---|---|---|
| CVE-2026-24061 | 9.8 | InetUtils telnetd | — | 26 Jan 2026 |
| CVE-2014-6278 | 8.8 | GNU Bash | 2014 | 2 Oct 2025 |
Why a decade-old Bash bug is still making KEV in 2025
CVE-2014-6278 is a Shellshock-family vulnerability, part of the same 2014 disclosure cluster that includes CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277 — Bash's now-infamous failure to properly parse function definitions embedded in environment variable values, which let remote attackers execute arbitrary commands anywhere an environment variable crosses a privilege boundary into a Bash process. NVD's description explicitly notes this CVE exists "because of an incomplete fix" for the earlier three, meaning even the original patch round for Shellshock didn't fully close the hole. That this specific variant is only now landing on the KEV catalogue, more than a decade after initial disclosure, tells you something important: Bash is embedded so deeply and pervasively across legacy systems, embedded devices, and infrastructure that was patched for the headline Shellshock CVEs but never revisited for its lesser-known siblings, that exploitation attempts against this specific variant are still finding live, unpatched targets in 2025.
CVE-2026-24061 shares the same underlying category of bug — improper handling of untrusted input crossing into command execution — but through a completely different mechanism. It's an argument injection vulnerability in InetUtils' telnetd, where a remote, unauthenticated attacker can bypass authentication entirely by supplying the string "-f root" as the value of the USER environment variable during a telnet session. Telnetd interprets that value as a command-line flag rather than pure data, and "-f root" instructs it to skip login and grant root access directly. This is CWE-88, argument injection, and it's structurally the same class of failure as Shellshock: a program trusts a value that arrives from outside its trust boundary and treats it as something more privileged than data.
What to check this week
Inventory every system still running telnetd, especially InetUtils' implementation — telnet as a protocol has been considered obsolete for interactive remote administration for years, and CVE-2026-24061's unauthenticated root-bypass severity (CVSS 9.8) should be the final argument for disabling or removing it entirely rather than patching in place, if that's operationally feasible.
Don't assume your 2014 Shellshock remediation covered this Bash variant — CVE-2014-6278 exists specifically because the original fix round was incomplete, so environments that patched only against the original CVE-2014-6271 disclosure may still carry this gap more than a decade later.
Audit CGI scripts, SSH ForceCommand configurations, and DHCP client scripts specifically, since NVD's own description of CVE-2014-6278 names Apache's mod_cgi/mod_cgid, OpenSSH's ForceCommand feature, and DHCP client scripts as the concrete vectors demonstrated for this exact vulnerability.
Treat any legacy or embedded system running an old GNU toolchain as a candidate for both CVEs, since organizations that haven't modernized their Unix userland in years are statistically the same organizations exposing both Bash and telnetd without recent patching.
Why foundational tooling ages differently than applications
Applications get replaced, redesigned, and re-audited on a business cycle. Foundational Unix tooling like Bash and InetUtils, by contrast, often ships once inside an appliance, embedded device, or base OS image and then persists unmodified for the operational lifetime of that device — sometimes a decade or more. That's precisely why a 2014 Bash vulnerability variant is only reaching confirmed-exploitation status in KEV now: the population of systems still carrying it is disproportionately made up of exactly the long-lived, rarely-touched infrastructure that never gets folded into a routine patch cycle.
A final consideration on protocol-level obsolescence
Telnet's fundamental security model — plaintext credentials and no meaningful authentication rigor — was already considered inadequate for production use well before CVE-2026-24061 was discovered. This vulnerability doesn't create new risk in the telnet protocol so much as it demonstrates a variant of it: if telnetd is still reachable anywhere in your environment, the argument-injection bug is one additional reason among many that already existed to eliminate it rather than patch around it.
How Safeguard helps
Safeguard's continuous inventory surfaces foundational, easily-overlooked components like Bash builds and legacy network daemons such as telnetd across an organization's full estate, including the embedded and long-lived systems where a decade-old vulnerability variant is most likely to still be sitting unpatched and unnoticed.
