Vulnerability Description
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Deloitte | Ai Assist For Customer | < 2026-03-25 |
Related Weaknesses (CWE)
References
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/Technical Description
- https://www.cve.org/CVERecord?id=CVE-2026-57476
- https://zerotolerance.me/advisories/assets/VU487875-deloitte-ascend-advisory.pdfThird Party Advisory
- https://zerotolerance.me/advisories/deloitte-aiassist-ascend-2026-vu487875/Third Party Advisory
FAQ
What is CVE-2026-57476?
CVE-2026-57476 is a vulnerability with a CVSS score of 4.8 (MEDIUM). Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented gener...
How severe is CVE-2026-57476?
CVE-2026-57476 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-57476?
Check the references section above for vendor advisories and patch information. Affected products include: Deloitte Ai Assist For Customer.