CVE-2026-57475
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Deloitte AI Assist for Customer accepted unauthenticated POST requests through public API endpoints, allowing a remote attacker to make limited configuration changes. These changes were not used by the system. Since 2026-03-25, network access has been restricted and authentication enforced.
Risk Assessment
The organization was at risk of unauthorized configuration changes, although they did not affect system operation.
Recommendation
Ensure network access to the API is restricted and authentication is required.
Other vulnerabilities in Deloitte AI Assist for Customer
See all- CVE-2026-57476Medium
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the RAG corpus. On 2026-03-25, network access was restricted and authentication was enforced for the previously exposed endpoints.
- CVE-2026-57474Medium
Deloitte AI Assist for Customer exposed configuration information through public API endpoints that accepted unauthenticated requests. This information could reduce an attacker's reconnaissance effort. As of 2026-03-25, network access was restricted and authentication enforced.
Original NVD description (English source)
Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.