A few days ago two related security issues affecting the bash login shell were announced. These issues are not affecting our production service. Cumulocity does not use CGI/mod_cgi and does not allow generic SSH access to production systems.
Nevertheless, we are running now the corrected, patched version of the bash shell.
The Cumulocity support team