Shellshock had the potential for an unauthorized user to gain access to a server. It affected many internet- facing services, which OS did it not directly affect?

Windows environments with optional Bash installations such as Cygwin or Git Bash could be exposed to Shellshock, making Windows potentially vulnerable unlike OS X which was patched rapidly due to its limited server attack surface.

Unix systems natively use Bash and were among the most directly affected by Shellshock, particularly those operating as web servers with CGI script execution enabled.

Linux servers running Bash were the primary and most widely exploited targets of Shellshock, especially those hosting CGI scripts through Apache or nginx with mod_cgi.

Shellshock exploited a flaw in GNU Bash that allowed arbitrary commands to be injected via crafted environment variables, and its most impactful attack vector was CGI-based web servers running on Unix and Linux. OS X ships with Bash but was not commonly deployed as an internet-facing CGI server, significantly limiting its direct exposure compared to production server operating systems. Apple did release patches for OS X, but the operational risk was far lower given its desktop-centric deployment profile.