{"schema":"threatline.record/2","record":{"id":"CVE-2026-107194","aliases":[],"summary":"Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via \"login_type\":\"5\" in a login request, potentially leading to \"local blackouts on the whole continent\" in Euro","details":"Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via \"login_type\":\"5\" in a login request, potentially leading to \"local blackouts on the whole continent\" in Europe. An email address for the user_account property is required; however, a user can view the email address associated with their parent organization.","categories":["Unclassified"],"product":"iSolarCloud","vendor":"Sungrow","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107194","source_modified_at":"2026-10-19T14:03:48.206Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"iSolarCloud","vendor":"Sungrow","versions":[{"lessThan":"2026-08-25","status":"affected","version":"0","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107194","source_modified_at":"2026-10-19T14:03:48.206Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"iSolarCloud","ecosystem":null},"version":"2026-08-25","basis":"first unaffected version stated in the CVE record"}],"cvss":9.2,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00423,"percentile":0.35533,"score_date":"2026-10-23"},"published_at":"2026-10-07T13:54:45.211Z","modified_at":"2026-10-19T14:03:48.206Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-107194","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T14:03:48.206Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107194","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.sungrowpower.com/en/products/cloud-software/isolarcloud"},{"source":"CVE List","url":"https://jakkaru.de/articles/sungrow-vulnerability-exposes-gigawatts-worldwide"},{"source":"CVE List","url":"https://www.sungrowpower.com/en/login-bypass-vulnerability-in-sungrow-isolarcloud"},{"source":"CVE List","url":"https://www.linkedin.com/posts/patrick-lamplmair-0aa66715b_otsecurity-gridsecurity-solarenergy-activity-7514199420771393536-HAi3"},{"source":"CVE List","url":"https://www.pv-magazine.com/2026/10/08/sungrow-patches-isolarcloud-vulnerability-after-security-researchers-gain-access/"},{"source":"CVE List","url":"https://www.pv-tech.org/sungrow-patches-cloud-vulnerability-affecting-solar-inverters/"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2026-10-10T02:23:16.633923Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-19T14:03:48.206Z","content_hash":"ae9cb7e40049ff986126871b1bdcbb261c53c70219d4908f78db5557cd4ad02f"}}