Cpe:2.3:a:ibm:bob:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aibmbob/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 20:56:28 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgIBM Bob: Remote code execution via workspace-defined MCP server (CVE-2026-9764)https://feed.craftedsignal.io/briefs/2026-11-cve-2026-9764/Sun, 08 Nov 2026 20:56:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-9764/A remote code execution vulnerability exists in IBM Bob (versions 1.0.4 through 2.0.1) due to improper control of workspace-defined MCP servers and user input, which is now subject to public exploit code.IBM Bob (versions 1.0.4 through 2.0.1) is vulnerable to a remote code execution vulnerability (CVE-2026-9764). The flaw arises from improper control of workspace-defined MCP servers, allowing an attacker to inject and execute arbitrary code. Successful exploitation requires network access and user interaction. IBM has published security guidance for this vulnerability.

Impact

Successful exploitation allows a remote attacker to achieve arbitrary code execution on the target system, resulting in a full compromise of confidentiality, integrity, and availability (CVSS 8.8).

Recommendation

  • Review the official IBM security advisory for mitigation and patching details at the provided reference.
  • Audit all instances of IBM Bob within the environment to identify versions 1.0.4 through 2.0.1.
  • Prioritize the application of vendor-supplied patches to remediate CVE-2026-9764.
  • Monitor network traffic for unusual outbound connections from the IBM Bob server, particularly those initiated following user interaction or workspace configuration changes.
]]>highadvisorycve-2026-9764remote-code-executionibm