Log in Start free

Vulnerability · Published Jul 10, 2026 · Assigned by cisa-cg

CVE-2026-57475Deloitte AI Assist for Customer unauthenticated configuration write

Medium 5.3

In plain English

A medium-severity missing authentication in AI Assist for Customer from Deloitte. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.6%top 51.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.

Affected products (as reported)

VendorProductVersions
Deloitte AI Assist for Customer 0 – before 2026-03-25

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

  • url third-party-advisory
  • url third-party-advisory
  • url vdb-entry
  • url third-party-advisory