cyfenced.com →

[ CVE-2026-107194 · Published 7 Oct 2026 ]

Vulnerability in Sungrow iSolarCloud

CVSS 9.2 EPSS <1%No fix listed yet

[ Why it matters ]Priority signals

  • Critical severity: CVSS 9.2

[ Description ]Official description

Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading to "local blackouts on the whole continent" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References