CVE-2026-57474
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Deloitte AI Assist for Customer exposed configuration information through public API endpoints that accepted unauthenticated requests. This information could reduce an attacker's reconnaissance effort. As of 2026-03-25, network access was restricted and authentication enforced.
Risk Assessment
An attacker can gather system configuration details, facilitating further attacks such as privilege escalation or data theft.
Recommendation
Ensure API endpoints are protected with authentication and network restrictions, as per the update from 2026-03-25.
Other vulnerabilities in Deloitte AI Assist for Customer
See all- CVE-2026-57476Medium
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the RAG corpus. On 2026-03-25, network access was restricted and authentication was enforced for the previously exposed endpoints.
- CVE-2026-57475Medium
Deloitte AI Assist for Customer accepted unauthenticated POST requests through public API endpoints, allowing a remote attacker to make limited configuration changes. These changes were not used by the system. Since 2026-03-25, network access has been restricted and authentication enforced.
Original NVD description (English source)
Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accepted unauthenticated requests. This information could reduce an attacker’s reconnaissance effort. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.