CVE-2014-6278

public exploits

Public exploit code: 5 on Exploit-DB · 3 Metasploit modules

Listed so you can judge urgency, not as a recommendation to run anything. GitHub “proofs of concept” are unvetted: some are fake or carry malware. Exploit-DB marks the entries its staff verified.

cisa ssvc

exploitation

active

automatable

no

technical impact

total

Assessed by CISA 2 Oct 2025 (SSVC 2.0.3).

timeline

1. 29 Sept 2014First public exploit or proof of concept
2. 30 Sept 2014Published · 1 day later
3. 2 Oct 2025Added to CISA KEV (exploited in the wild) · 4,020 days (about 11 years) later
4. 2 Oct 2025CISA SSVC assessment: exploitation active · same day later
5. 23 Oct 2025CISA remediation due date (US federal agencies) · 21 days later
6. 30 Dec 2025CVE record last updated · 69 days (about 2 months) later
7. 2 Nov 2026Analysed by vulneraibility.com · 307 days (about 10 months) later