Vulnerability · Published Aug 20, 2026 · Assigned by TR-CERT

CVE-2026-15706Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS

Critical 9.8

In plain English

A critical-severity missing authentication in Baylan Smart Meter Management Application (BMS) from Baylan Measuring Instruments Industry and Trade Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.6%top 49.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.

Affected products (as reported)

Vendor	Product	Versions
Baylan Measuring Instruments Industry and Trade Inc.	Baylan Smart Meter Management Application (BMS)	0 – before v1.1.10.142

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0881 government-resource