CVE-2026-57475CWE-306

CVE-2026-57475

Medium · published July 10, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
48.0
In the wild
Unconfirmed
What it is

Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00598 · 48.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-07-10T22:16Z
Affected products (1)
ProductVersionsFixed in
deloitte/ai_assist_for_customer< 2026-03-252026-03-25
References (4)
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-191-01.json · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2026-57475 · 9119a7d8-5eab-497f-8521-727c672e3725https://zerotolerance.me/advisories/assets/VU487875-deloitte-ascend-advisory.pdf · 9119a7d8-5eab-497f-8521-727c672e3725https://zerotolerance.me/advisories/deloitte-aiassist-ascend-2026-vu487875/ · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 10 JUL 17:10Z
    Deloitte AI Assist for Customer unauthenticated configuration write
    cvelistv5