This vulnerability (CVE-2026-39480) affects Inisev Backup Migration software versions up to 2.1.1 and involves the unauthenticated exposure of sensitive data during backup migration processes. Classified under CWE-201, it indicates that sensitive information is improperly inserted into data sent by the application, allowing attackers to access it without authentication. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. No vendor advisory or patch information is currently available, and no exploits are known in the wild.

An unauthenticated attacker can gain access to sensitive information from the Backup Migration software, potentially leading to confidentiality breaches. The integrity and availability of the system are not impacted. The vulnerability can be exploited remotely without any authentication or user interaction, increasing the risk of data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the Backup Migration service to trusted networks and monitor for unusual access patterns. Avoid exposing the service to untrusted networks. Follow vendor communications closely for updates on patches or mitigations.