Advisory · CVE-2026-9764
IBM Bob code injection can run arbitrary code on the system
IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system due to the improper control of user input code, rated high at CVSS 8.8.
- Vendor
- IBM
- Product
- Bob
- Identifier / CWE
- CVE-2026-9764
CWE-94 - Action timing
- Immediate
Explain it like I’m five
IBM Bob runs code that users supply, and it does not control that code tightly enough. A remote attacker can inject their own code and have the system run it.
- 01Crafted input sent
A remote attacker sends input carrying code to Bob.
- 02Control skipped
The improper control of user input code lets the payload through.
- 03Code injected
Arbitrary code is injected on the system.
- 04Code runs
The injected code executes with the service's privileges.
What happened
IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code. The record rates it high at CVSS 8.8 under version 3.1, with network attack vector, low complexity, no privileges required, and user interaction required.
IBM’s bulletin lists the affected versions and the fix. Remote code injection with user interaction still only needs one person to open the wrong thing.
What to do
- Inventory Bob deployments and record each version.
- Check the IBM bulletin for the fix and apply it.
- Review logs for code injection attempts.
- Treat the host as potentially compromised if exploitation cannot be excluded.
- Verify the deployed version after updating.
Management note
Code injection is code execution by another name. Patch Bob and check what ran.