Is CVE-2026-9765 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9765 being exploited in the wild.

How severe is CVE-2026-9765?

High severity, with a CVSS score of 7.1, published 24 July 2026.

Which products and versions are affected?

Grafana Labs IRM 1.0.0 to 1.164.0.

Is there a fix for CVE-2026-9765?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9765 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-9765?

Check whether you run Grafana Labs IRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9765: Grafana Labs Grafana IRM broken access control

CVE-2026-9765 · Severity: high · CVSS 7.1 · Published 2026-07-24

A security flaw was identified in Grafana IRM, a tool used by organizations to manage and respond to IT incidents. The vulnerability allows an authenticated user to bypass security rules and access or modify resources they should not be able to reach. This could lead to unauthorized changes to incident data or the takeover of other user accounts within the platform.

Vendors: Grafana Labs.

Quick answers

Is CVE-2026-9765 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9765 being exploited in the wild.
How severe is CVE-2026-9765?: High severity, with a CVSS score of 7.1, published 24 July 2026.
Which products and versions are affected?: Grafana Labs IRM 1.0.0 to 1.164.0.
Is there a fix for CVE-2026-9765?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9765 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-9765?: Check whether you run Grafana Labs IRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A broken access control vulnerability exists in Grafana IRM versions 1.0.0 through 1.164.0. The flaw allows a network-based attacker with low-level authenticated privileges to bypass authorization mechanisms. By exploiting this, an attacker can perform operations on behalf of other users, potentially leading to privilege escalation or account takeover. Although originally assigned a CVE, the vendor has noted this is a cloud-only issue, suggesting the fix is managed within the Grafana Cloud environment.

Affected products

Grafana Labs Grafana IRM 1.0.0 to 1.164.0

Timeline

2026-07-24: disclosed: Initial publication of the vulnerability details.
2026-07-24: advisory: NVD record published based on Grafana Labs data.

References

https://grafana.com/security/security-advisories/cve-2026-9765

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.