CVE-2026-9764

Summary

IBM Bob versions 1.0.4 through 2.0.1 contain a code injection vulnerability (CWE-94) where insufficient input validation allows remote attackers to inject and execute arbitrary code on the target system. This is a high-severity flaw (CVSS 8.8) due to network accessibility, low attack complexity, and high impact across confidentiality, integrity, and availability.

Exploitability

Exploitation requires user interaction (e.g.,诱使 a user open a maliciously crafted message or file) and no prior authentication, making it moderately easy for an attacker to trigger the vulnerability remotely.

Blast radius

Successful exploitation could lead to full system compromise, including data theft, malware deployment, or lateral movement within the affected network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to IBM Bob version 2.0.2 or later, as this is the first fixed release addressing CVE-2026-9764.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.