CVE-2026-9764
IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution
- 8.8HighCVSS base score
- 0.29%Exploitation in 30 daysEPSS · top 78% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.
Timeline
ID reserved
By ibm
- 6 months later
· 6 months later
Published
- 1 day later
· 1 day later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ibmCNA (assigner) | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVDNVD · Awaiting Analysis | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.29% · top 78% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Affected products
What to do
Solution: IBM strongly recommends addressing the vulnerability now by upgrading to IBM Bob Shell V 2.0.2 or the later https://bob.ibm.com/docs/shell . We recommend reviewing the documentation for guidance on installing IBM Bob https://bob.ibm.com/docs/ide/getting-started/install .
Workaround: Until an upgrade can be applied, IBM recommends the following precautions: Only use IBM Bob Shell with trusted repositories and trusted code sources. Avoid opening repositories obtained from unknown or untrusted parties. Review repository contents and configuration before use in shared or public environments. Follow organizational security practices for validating and approving source code repositories. Note: These mitigations reduce exposure but do not fully address the vulnerability. IBM recommends upgrading to IBM Bob Shell version 2.0.2 or later as the preferred remediation.
References
References1
- https://www.ibm.com/support/pages/node/7291535 (opens in a new tab)vendor-advisorypatch
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-119740 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-9764)Record last updated .