CVE-2026-39571

CVE-2026-39571 is an information disclosure vulnerability affecting Themefic Instantio versions 3.3.30 and earlier, which allows unauthorized access to retrieve embedded sensitive system data. The flaw exposes sensitive information to an unauthorized control sphere, potentially compromising confidential system details. This vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and shows no evidence of active exploitation in the threat landscape. The vulnerability has a CVSS 3.1 score of 5.3 (MEDIUM severity) with a network-based attack vector requiring no authentication or user interaction, indicating relatively low attack complexity. The impact is limited to confidentiality concerns with no integrity or availability implications. The EPSS score of 0.00036 suggests minimal probability of exploitation within the next 30 days, and the FAUCET Risk Score of 32/100 indicates low overall risk relative to other vulnerabilities. Given the lack of public exploit code, absence from active threat lists, and low exploitation metrics, this vulnerability currently represents a manageable risk. Organizations running affected Instantio versions should prioritize patching based on their asset inventory and data sensitivity, but this is not an urgent security incident requiring immediate response.