A critical authentication bypass in Sungrow’s iSolarCloud platform gave researchers access to connected solar and battery systems across multiple regions, highlighting the grid-level risks of centralised renewable-energy management.
A serious flaw in Sungrow’s iSolarCloud platform has raised fresh concerns about the cyber security of large-scale solar fleets, after researchers said they were able to bypass authentication and reach connected systems without the normal credentials. According to reporting by pv magazine, the issue affected the company’s cloud layer rather than a single device model, which meant the exposure extended across every iSolarCloud region, including Europe, China, Australia and the rest of the world. The scale matters because cloud-managed inverters and batteries are increasingly tied to a single administrative plane, turning what might look like a product flaw into a much broader operational risk.
The technical concern is not limited to viewing data. The researcher involved told Die Zeit that, with administrator-level access, it would have been possible to enumerate installations, alter settings, start or stop inverters and batteries, and in some cases push firmware to connected devices. Sungrow disputed the full practical reach of the access, saying the authentication bypass did not by itself expose the most sensitive inverter settings because an additional password protection layer remained in place. Even so, the existence of a pathway past the first line of defence is significant in a system designed to manage physical energy assets remotely.
The number of affected systems appears substantial. ComputerBase, citing the German reporting, said roughly 470,000 Sungrow installations were connected to the cloud in Europe, with about 250,000 in Germany alone. Those German systems were said to represent 7.8GW of peak capacity, while a dashboard capture from the manufacturer reportedly showed close to 18GW of live production across Europe at the end of August. A separate vulnerability listing described the issue as CVE-2026-107194, a critical authentication bypass rated 9.2 on the CVSS scale, underlining how seriously the flaw has been treated by security observers.
The wider concern is how many small, distributed energy assets can create a large systemic exposure when they are managed through one cloud service. Harm van den Brink, a cybersecurity researcher focused on energy infrastructure and a member of the Dutch Institute for Vulnerability Disclosure, said continental Europe’s primary frequency reserve is sized around a reference incident of 3GW. That does not mean the Sungrow issue would have caused a blackout, but it does illustrate why coordinated interference at scale would worry grid operators. TechRadar has separately reported that researchers have found numerous solar inverter flaws across vendors, including weaknesses capable of remote code execution, denial of service and device takeover, reinforcing the view that inverter security is now a grid-level issue rather than a niche product problem.
Sungrow said the vulnerability was patched quickly, with pv magazine reporting that the company deployed an emergency fix across all iSolarCloud levels on 25 August 2026 and resolved the issue the same day. That rapid response is important, but it does not answer the broader governance question now hanging over the incident: who was told, how widely the affected accounts were exposed, and whether regulators and customers were informed in full. Sungrow’s own incident-response material says it operates a product security team and follows responsible disclosure practices, yet this case shows that the regulatory framework still lags behind the operational reality of networked solar infrastructure.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
