high8.8
CVE-2026-9764
IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.
Impact
IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.
An attacker can exploit this over the network, without logging in, but a user has to do something, such as open a file or a link. If it succeeds: high risk of data being read, high risk of data or systems being changed, high risk of outages.
Affected products · IBM
| Product | Affected versions |
|---|---|
| Bob Shell | from 1.0.4 through 2.0.1 Version 1.0.4 ≤2.0.1 |