Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by Deloitte
CVE-2026-57476 (GCVE-0-2026-57476)
Vulnerability from nvd – Published: 2026-07-10 17:10 – Updated: 2026-07-10 17:10 Exclusively Hosted Service
VLAI
EPSS
VEX
Title
Deloitte AI Assist for Customer unauthenticated RAG corpus read and write
Summary
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.
Severity
4.8 (Medium)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://zerotolerance.me/advisories/deloitte-aias… | third-party-advisory |
| https://zerotolerance.me/advisories/assets/VU4878… | third-party-advisory |
| https://raw.githubusercontent.com/cisagov/CSAF/de… | third-party-advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-57474 | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Deloitte | AI Assist for Customer |
Affected:
0 , < 2026-03-25
(custom)
Unaffected: 2026-03-25 |
Date Public
2026-05-18 00:00
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "AI Assist for Customer",
"vendor": "Deloitte",
"versions": [
{
"lessThan": "2026-03-25",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2026-03-25"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Karim El Labban, Zero Tolerance"
}
],
"datePublic": "2026-05-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
},
{
"other": {
"content": {
"id": "CVE-2026-57476",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-23T18:31:21.217805Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T17:10:50.682Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://zerotolerance.me/advisories/deloitte-aiassist-ascend-2026-vu487875/"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://zerotolerance.me/advisories/assets/VU487875-deloitte-ascend-advisory.pdf"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-191-01.json"
},
{
"name": "url",
"tags": [
"vdb-entry"
],
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57474"
}
],
"tags": [
"exclusively-hosted-service"
],
"title": "Deloitte AI Assist for Customer unauthenticated RAG corpus read and write"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-57476",
"datePublished": "2026-07-10T17:10:50.682Z",
"dateReserved": "2026-06-24T13:52:15.600Z",
"dateUpdated": "2026-07-10T17:10:50.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57475 (GCVE-0-2026-57475)
Vulnerability from nvd – Published: 2026-07-10 17:10 – Updated: 2026-07-10 17:10 Exclusively Hosted Service
VLAI
EPSS
VEX
Title
Deloitte AI Assist for Customer unauthenticated configuration write
Summary
Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.
Severity
5.3 (Medium)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://zerotolerance.me/advisories/deloitte-aias… | third-party-advisory |
| https://zerotolerance.me/advisories/assets/VU4878… | third-party-advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-57474 | vdb-entry |
| https://raw.githubusercontent.com/cisagov/CSAF/de… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Deloitte | AI Assist for Customer |
Affected:
0 , < 2026-03-25
(custom)
Unaffected: 2026-03-25 |
Date Public
2026-05-18 00:00
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "AI Assist for Customer",
"vendor": "Deloitte",
"versions": [
{
"lessThan": "2026-03-25",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2026-03-25"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Karim El Labban, Zero Tolerance"
}
],
"datePublic": "2026-05-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
},
{
"other": {
"content": {
"id": "CVE-2026-57475",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-23T18:30:43.710557Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T17:10:35.437Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://zerotolerance.me/advisories/deloitte-aiassist-ascend-2026-vu487875/"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://zerotolerance.me/advisories/assets/VU487875-deloitte-ascend-advisory.pdf"
},
{
"name": "url",
"tags": [
"vdb-entry"
],
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57474"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-191-01.json"
}
],
"tags": [
"exclusively-hosted-service"
],
"title": "Deloitte AI Assist for Customer unauthenticated configuration write"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-57475",
"datePublished": "2026-07-10T17:10:35.437Z",
"dateReserved": "2026-06-24T13:52:07.929Z",
"dateUpdated": "2026-07-10T17:10:35.437Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57474 (GCVE-0-2026-57474)
Vulnerability from nvd – Published: 2026-07-10 17:10 – Updated: 2026-07-10 17:10 Exclusively Hosted Service
VLAI
EPSS
VEX
Title
Deloitte AI Assist for Customer information disclosure
Summary
Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accepted unauthenticated requests. This information could reduce an attacker’s reconnaissance effort. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.
Severity
5.3 (Medium)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://zerotolerance.me/advisories/deloitte-aias… | third-party-advisory |
| https://zerotolerance.me/advisories/assets/VU4878… | third-party-advisory |
| https://raw.githubusercontent.com/cisagov/CSAF/de… | third-party-advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-57474 | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Deloitte | AI Assist for Customer |
Affected:
0 , < 2026-03-25
(custom)
Unaffected: 2026-03-25 |
Date Public
2026-05-18 00:00
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "AI Assist for Customer",
"vendor": "Deloitte",
"versions": [
{
"lessThan": "2026-03-25",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2026-03-25"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Karim El Labban, Zero Tolerance"
}
],
"datePublic": "2026-05-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accepted unauthenticated requests. This information could reduce an attacker\u2019s reconnaissance effort. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
},
{
"other": {
"content": {
"id": "CVE-2026-57474",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-23T18:28:53.791135Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T17:10:15.585Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://zerotolerance.me/advisories/deloitte-aiassist-ascend-2026-vu487875/"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://zerotolerance.me/advisories/assets/VU487875-deloitte-ascend-advisory.pdf"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-191-01.json"
},
{
"name": "url",
"tags": [
"vdb-entry"
],
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57474"
}
],
"tags": [
"exclusively-hosted-service"
],
"title": "Deloitte AI Assist for Customer information disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-57474",
"datePublished": "2026-07-10T17:10:15.585Z",
"dateReserved": "2026-06-24T13:52:00.373Z",
"dateUpdated": "2026-07-10T17:10:15.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57476 (GCVE-0-2026-57476)
Vulnerability from cvelistv5 – Published: 2026-07-10 17:10 – Updated: 2026-07-10 17:10 Exclusively Hosted Service
VLAI
EPSS
VEX
Title
Deloitte AI Assist for Customer unauthenticated RAG corpus read and write
Summary
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.
Severity
4.8 (Medium)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://zerotolerance.me/advisories/deloitte-aias… | third-party-advisory |
| https://zerotolerance.me/advisories/assets/VU4878… | third-party-advisory |
| https://raw.githubusercontent.com/cisagov/CSAF/de… | third-party-advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-57474 | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Deloitte | AI Assist for Customer |
Affected:
0 , < 2026-03-25
(custom)
Unaffected: 2026-03-25 |
Date Public
2026-05-18 00:00
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "AI Assist for Customer",
"vendor": "Deloitte",
"versions": [
{
"lessThan": "2026-03-25",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2026-03-25"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Karim El Labban, Zero Tolerance"
}
],
"datePublic": "2026-05-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
},
{
"other": {
"content": {
"id": "CVE-2026-57476",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-23T18:31:21.217805Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T17:10:50.682Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://zerotolerance.me/advisories/deloitte-aiassist-ascend-2026-vu487875/"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://zerotolerance.me/advisories/assets/VU487875-deloitte-ascend-advisory.pdf"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-191-01.json"
},
{
"name": "url",
"tags": [
"vdb-entry"
],
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57474"
}
],
"tags": [
"exclusively-hosted-service"
],
"title": "Deloitte AI Assist for Customer unauthenticated RAG corpus read and write"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-57476",
"datePublished": "2026-07-10T17:10:50.682Z",
"dateReserved": "2026-06-24T13:52:15.600Z",
"dateUpdated": "2026-07-10T17:10:50.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57475 (GCVE-0-2026-57475)
Vulnerability from cvelistv5 – Published: 2026-07-10 17:10 – Updated: 2026-07-10 17:10 Exclusively Hosted Service
VLAI
EPSS
VEX
Title
Deloitte AI Assist for Customer unauthenticated configuration write
Summary
Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.
Severity
5.3 (Medium)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://zerotolerance.me/advisories/deloitte-aias… | third-party-advisory |
| https://zerotolerance.me/advisories/assets/VU4878… | third-party-advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-57474 | vdb-entry |
| https://raw.githubusercontent.com/cisagov/CSAF/de… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Deloitte | AI Assist for Customer |
Affected:
0 , < 2026-03-25
(custom)
Unaffected: 2026-03-25 |
Date Public
2026-05-18 00:00
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "AI Assist for Customer",
"vendor": "Deloitte",
"versions": [
{
"lessThan": "2026-03-25",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2026-03-25"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Karim El Labban, Zero Tolerance"
}
],
"datePublic": "2026-05-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
},
{
"other": {
"content": {
"id": "CVE-2026-57475",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-23T18:30:43.710557Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T17:10:35.437Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://zerotolerance.me/advisories/deloitte-aiassist-ascend-2026-vu487875/"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://zerotolerance.me/advisories/assets/VU487875-deloitte-ascend-advisory.pdf"
},
{
"name": "url",
"tags": [
"vdb-entry"
],
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57474"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-191-01.json"
}
],
"tags": [
"exclusively-hosted-service"
],
"title": "Deloitte AI Assist for Customer unauthenticated configuration write"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-57475",
"datePublished": "2026-07-10T17:10:35.437Z",
"dateReserved": "2026-06-24T13:52:07.929Z",
"dateUpdated": "2026-07-10T17:10:35.437Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57474 (GCVE-0-2026-57474)
Vulnerability from cvelistv5 – Published: 2026-07-10 17:10 – Updated: 2026-07-10 17:10 Exclusively Hosted Service
VLAI
EPSS
VEX
Title
Deloitte AI Assist for Customer information disclosure
Summary
Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accepted unauthenticated requests. This information could reduce an attacker’s reconnaissance effort. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.
Severity
5.3 (Medium)
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://zerotolerance.me/advisories/deloitte-aias… | third-party-advisory |
| https://zerotolerance.me/advisories/assets/VU4878… | third-party-advisory |
| https://raw.githubusercontent.com/cisagov/CSAF/de… | third-party-advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-57474 | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Deloitte | AI Assist for Customer |
Affected:
0 , < 2026-03-25
(custom)
Unaffected: 2026-03-25 |
Date Public
2026-05-18 00:00
Credits
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "AI Assist for Customer",
"vendor": "Deloitte",
"versions": [
{
"lessThan": "2026-03-25",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2026-03-25"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Karim El Labban, Zero Tolerance"
}
],
"datePublic": "2026-05-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accepted unauthenticated requests. This information could reduce an attacker\u2019s reconnaissance effort. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
},
{
"other": {
"content": {
"id": "CVE-2026-57474",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-23T18:28:53.791135Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T17:10:15.585Z",
"orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"shortName": "cisa-cg"
},
"references": [
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://zerotolerance.me/advisories/deloitte-aiassist-ascend-2026-vu487875/"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://zerotolerance.me/advisories/assets/VU487875-deloitte-ascend-advisory.pdf"
},
{
"name": "url",
"tags": [
"third-party-advisory"
],
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-191-01.json"
},
{
"name": "url",
"tags": [
"vdb-entry"
],
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57474"
}
],
"tags": [
"exclusively-hosted-service"
],
"title": "Deloitte AI Assist for Customer information disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
"assignerShortName": "cisa-cg",
"cveId": "CVE-2026-57474",
"datePublished": "2026-07-10T17:10:15.585Z",
"dateReserved": "2026-06-24T13:52:00.373Z",
"dateUpdated": "2026-07-10T17:10:15.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}