CVE-2026-57476CWE-306

CVE-2026-57476

Medium · published July 10, 2026

CVSS v3.1

4.8

EPSS

Percentile

36.8

In the wild

Unconfirmed

What it is

Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.

The record

Technical detail

CVSS v3.1: 4.8 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00436 · 36.8th percentile
Weakness: CWE-306 · Missing Authentication for Critical Function
Published: 2026-07-10T22:16Z

Affected products (1)

Product	Versions	Fixed in
deloitte/ai_assist_for_customer	< 2026-03-25	2026-03-25

References (4)

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-191-01.json · 9119a7d8-5eab-497f-8521-727c672e3725 https://www.cve.org/CVERecord?id=CVE-2026-57476 · 9119a7d8-5eab-497f-8521-727c672e3725 https://zerotolerance.me/advisories/assets/VU487875-deloitte-ascend-advisory.pdf · 9119a7d8-5eab-497f-8521-727c672e3725 https://zerotolerance.me/advisories/deloitte-aiassist-ascend-2026-vu487875/ · 9119a7d8-5eab-497f-8521-727c672e3725

EPSS history

Timeline

10 JUL 17:10Z
Deloitte AI Assist for Customer unauthenticated RAG corpus read and write
cvelistv5