Sungrow iSolarCloud EUVD-2026-94332

Exploitation requires sending a login request to the iSolarCloud API with the parameter "login_type":"5" and supplying the target account's email address in the user_account property; the auth bypass itself needs no valid credentials. The principal limiting factor is knowledge of the victim's email address - however, the description states a user can view the email associated with their parent organization, so a legitimate sub-account holder can readily obtain a target email, weakening this constraint for insider/tenant-adjacent abuse. Network reachability to the iSolarCloud service is required; no user interaction or pre-existing privilege on the target account is needed. Affected: Sungrow iSolarCloud versions 'before 2026' (exact fixed build not specified in available data).

This is a genuine high-priority issue, not a CVSS-inflated one. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable authentication bypass requiring no privileges or user interaction, scoring 9.2 with high integrity and availability impact to both the vulnerable system and subsequent systems (VI:H/VA:H/SC:H/SI:H/SA:H) - consistent with a cloud platform whose compromise cascades to the physical inverters it manages. The one mitigating signal is AT:P (attack requirement present): exploitation is gated by needing the victim account's email address, though the description notes a user can read the email of their parent organization, substantially lowering that barrier for insiders or sub-accounts. No EPSS score, CISA KEV listing, or confirmed public exploit code was provided, so exploitation is unproven in the wild despite the critical score. The 'local blackouts on the whole continent' claim in the description appears to derive from the referenced jakkaru.de research write-up rather than from vendor or CISA confirmation and should be treated as a researcher impact projection, not a confirmed consequence - verify with the vendor. Overall: a credible, easily-triggered auth bypass in an energy-sector cloud platform warranting prompt patching, with the email prerequisite as the main real-world friction.

An attacker (or a low-privileged sub-account user who can view their parent organization's email) sends a crafted login request to iSolarCloud containing "login_type":"5" and the target's email as user_account, bypassing authentication and taking over the account. With control of the cloud account, the attacker can manipulate the associated solar inverter fleet. No public exploit code was identified in the provided data, but the mechanism is simple and well-documented in the referenced research.