CVE-2026-9764: IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution

Q: Which releases are affected?

The affected range is IBM Bob 1.0.4 through 2.0.1. The provided data identifies the software as IBM Bob Shell.

Q: Does exploitation require authentication or user interaction?

The CVSS vector indicates that an attacker does not need privileges, but user interaction is required. The attack can be conducted over the network and has low attack complexity.

Q: What is the potential impact of successful exploitation?

Successful exploitation can allow arbitrary code injection on the affected system. The reported impact includes high confidentiality, integrity, and availability effects.

Published Oct 7, 2026

Updated

IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

Other sources

IBM Bob could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

— IBM

Affected Software

1 affected component

IBM Bob Shell<=1.0.4 to 2.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Bob Shell to a version that resolves this vulnerability.
Fixed in 2.0.2

Event History

Oct 7, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·06:48 PM

Data Sourced

via MITRE·06:48 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7291535

Frequently Asked Questions

Which releases are affected?

The affected range is IBM Bob 1.0.4 through 2.0.1. The provided data identifies the software as IBM Bob Shell.

Does exploitation require authentication or user interaction?

The CVSS vector indicates that an attacker does not need privileges, but user interaction is required. The attack can be conducted over the network and has low attack complexity.

What is the potential impact of successful exploitation?

Successful exploitation can allow arbitrary code injection on the affected system. The reported impact includes high confidentiality, integrity, and availability effects.

CVE-2026-9764: IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which releases are affected?

Does exploitation require authentication or user interaction?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which releases are affected?

Does exploitation require authentication or user interaction?

What is the potential impact of successful exploitation?