CVE-2026-57476: Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retri

mediumCVSS 4.8CVE-2026-57476

Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 4.8
Published: 2026-07-10
Last updated: 2026-07-10
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-57476

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-57476	coverage & exploitation status	NVD · CVE.org

Recent advisories for Deloitte AI Assist

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-57475: Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing A…nvd · 2026-07-10
mediumCVE-2026-57474: Deloitte AI Assist for Customer disclosed some configuration information through public-facing…nvd · 2026-07-10

CVE-2026-57476: Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retri

Details

Referenced CVEs

Recent advisories for Deloitte AI Assist

More from NVD Recent CVEs