CVE-2026-9764
IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution
IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.
CVSS 3.1 · 8.8 High
EPSS < 1%
KEV · Not listed
Vendors
Products