CVE-2026-107194
Severity not reportedData quality: awaiting analysis.
NVD has not completed analysis, so CVSS and affected-product data may be missing or change.
Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local…
Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization.
CVSS
—
Awaiting analysis by NVD
Timeline (UTC)
Published: 2026-10-07 14:17
Modified: 2026-10-19 15:16
NVD status: Awaiting Analysis
Last synced 2 days ago
Verified against the source API 2026-10-27 06:58 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://jakkaru.de/articles/sungrow-vulnerability-exposes-gigawatts-worldwide cve@mitre.org
- https://www.sungrowpower.com/en/products/cloud-software/isolarcloud cve@mitre.org
- https://www.linkedin.com/posts/patrick-lamplmair-0aa66715b_otsecurity-gridsecurity-solaren... af854a3a-2127-422b-91ae-364da2661108
- https://www.pv-magazine.com/2026/10/08/sungrow-patches-isolarcloud-vulnerability-after-sec... af854a3a-2127-422b-91ae-364da2661108
- https://www.pv-tech.org/sungrow-patches-cloud-vulnerability-affecting-solar-inverters/ af854a3a-2127-422b-91ae-364da2661108
- https://www.sungrowpower.com/en/login-bypass-vulnerability-in-sungrow-isolarcloud af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:58 UTC · record ↗