IBM Bob Shell EUVD-2026-119740

Exploitation requires victim user interaction (CVSS UI:R) - the attacker must get a user of IBM Bob to open or process crafted input; it is not fully autonomous server-side RCE. No authentication is required (PR:N) and the vector is network-based (AV:N) with low complexity (AC:L). Affected deployments are IBM Bob / Bob Shell versions 1.0.4 through 2.0.1; versions outside that range and patched installations are not exploitable. The exact product feature, protocol, or input path that triggers the code injection is not described in the available sources. The principal limiting factors are the required user interaction and the narrow, specific product/version scope.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a network-reachable, low-complexity, unauthenticated code-injection flaw (CWE-94) whose only gating factor is required user interaction (UI:R). On raw severity this is high, but the independent exploitation signals are weak: no EPSS score was provided, the vulnerability is not listed in CISA KEV, and no public proof-of-concept or exploit reference is present in the supplied data - so there is no evidence of active or imminent exploitation. The vendor's own priority label is 'this_week' (not act_now/emergency), which is consistent with 'patch promptly but not an active-exploitation emergency.' The practical risk is further tempered by the product itself: IBM 'Bob Shell' (bob_shell) appears to be a niche, low-footprint product, so even a reliable exploit would have a small attack surface across typical enterprise estates. Net: a genuinely high-severity RCE that warrants prompt patching on affected hosts, but current signals point to low real-world urgency rather than a widespread, must-drop-everything priority. Key missing data that would change this: EPSS probability and any confirmation of exploit availability - both absent here.

A remote attacker crafts malicious input and induces a user of IBM Bob (versions 1.0.4 through 2.0.1) to process or open it - the required user interaction (UI:R) - causing the application's improper handling of user-supplied code to execute attacker-controlled code on the host. The exact trigger mechanism is not described in the available sources. No public exploit identified at time of analysis, so an attacker would need to develop the exploit independently.