{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-9764/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:bob:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-9764"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Bob (1.0.4-2.0.1)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-9764","remote-code-execution","ibm"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM Bob (versions 1.0.4 through 2.0.1) is vulnerable to a remote code execution vulnerability (CVE-2026-9764). The flaw arises from improper control of workspace-defined MCP servers, allowing an attacker to inject and execute arbitrary code. Successful exploitation requires network access and user interaction. IBM has published security guidance for this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a remote attacker to achieve arbitrary code execution on the target system, resulting in a full compromise of confidentiality, integrity, and availability (CVSS 8.8).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReview the official IBM security advisory for mitigation and patching details at the provided reference.\u003c/li\u003e\n\u003cli\u003eAudit all instances of IBM Bob within the environment to identify versions 1.0.4 through 2.0.1.\u003c/li\u003e\n\u003cli\u003ePrioritize the application of vendor-supplied patches to remediate CVE-2026-9764.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic for unusual outbound connections from the IBM Bob server, particularly those initiated following user interaction or workspace configuration changes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T20:56:28Z","date_published":"2026-11-08T20:56:28Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-9764/","summary":"A remote code execution vulnerability exists in IBM Bob (versions 1.0.4 through 2.0.1) due to improper control of workspace-defined MCP servers and user input, which is now subject to public exploit code.","title":"IBM Bob: Remote code execution via workspace-defined MCP server (CVE-2026-9764)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-9764/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-9764","version":"https://jsonfeed.org/version/1.1"}