German security firm Jakkaru disclosed on 7 October 2026 a business-logic flaw in iSolarCloud, the cloud platform Sungrow uses to manage solar plants, inverters and battery storage. One value of the login_type field in the (encrypted and signed) login request made the service authenticate the account named in the request and ignore the password, so anyone who knew a user's email address could log in, with no email or other login alert to the owner, and could then use account recovery to keep control.

Customer and administrative accounts share the same management environment, so Jakkaru says a compromised administrator account could view and change plants, start or stop inverters and batteries, see registered organisations and users (including large German solar installers), and install custom firmware on any cloud-connected device. iSolarCloud runs four regional systems, European, Chinese, Australian and international, and the flaw was in all of them.

Jakkaru says Sungrow published a hotfix within a day of being told and began a root-cause review. CVE-2026-107194 was published on 7 October, and no exploitation is reported. Sungrow is one of the largest inverter makers, with more than 1,000 GW of converters installed by Jakkaru's count, and is common on Australian rooftops. Primary: Jakkaru; wire: Cyber Security News.

Correction (22 Oct 2026): this card said no CVE had been published. CVE-2026-107194 was published on 7 October, and Sungrow's own advisory SGSA-202608-0028 (10 October) rates it CVSS 4.0 9.2 Critical, says the flaw was fully remediated on 25 August 2026 with no customer action needed, and describes the access an attacker gained as viewing the account's device list, operating status and historical monitoring data; the wider impact on this card is Jakkaru's assessment. (source: Sungrow security advisory SGSA-202608-0028)