CVE-2026-107194: Sungrow iSolarCloud: Authentication bypass in login process allows account takeover

Summary

Sungrow iSolarCloud, a cloud platform for managing solar and battery storage plants, contains an authentication bypass in its login process (CWE-288). A specially crafted login request without a valid password can log in as the targeted user, which can lead to full control over plants, inverters and battery storage and access to linked user and organisation data. According to the researchers, no valid credentials are needed and the attack can be carried out remotely over the network. Sungrow reports that it fixed the issue centrally on its servers on 25 August 2026.

Affected

Sungrow iSolarCloud (cloud platform, all regions according to researchers)
CVE container: versions before 2026-08-25
MITRE record: listed as affected below 2026
Exact version strings: Unknown.

Fixed in

Server-side fix deployed by Sungrow on 25 August 2026 (no firmware or app update reported)
Sungrow advisory SGSA-202608-0028 (status: mitigated); full text not verified in this entry.

Workaround

No vendor workaround published. The vendor reports the platform is patched.

Exploitation

Sungrow reports no evidence that the flaw was exploited before the fix; these statements are not independently verified.
Not listed in the CISA KEV catalogue.
EPSS score: 0.00342.
No public proof-of-concept or exploit code found for this CVE.

Our recommendation

Review iSolarCloud login and account-activity logs for the period before 25 August 2026.
Reset passwords for all iSolarCloud accounts and enable multi-factor authentication if the platform offers it.
Review which accounts hold administrator or installer roles and remove unneeded ones.
Confirm the patch status with Sungrow's advisory before closing the topic internally.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Jakkaru: Sungrow vulnerability write-up jakkaru.de
Sungrow: Login bypass vulnerability advisory www.sungrowpower.com
Sungrow: Security incident response www.sungrowpower.com
Sungrow: iSolarCloud product page www.sungrowpower.com
pv magazine: Sungrow patches iSolarCloud vulnerability www.pv-magazine.com
PV Tech: Sungrow patches cloud vulnerability www.pv-tech.org
OpenCVE: CVE-2026-107194 app.opencve.io
Vulners: VULNRICHMENT CVE-2026-107194 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:50.

Original description (NVD)

Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization.

NVD references (6)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed