Vulnerability · Published Jul 10, 2026 · Assigned by cisa-cg

CVE-2026-57476Deloitte AI Assist for Customer unauthenticated RAG corpus read and write

Medium 4.8

In plain English

A medium-severity missing authentication in AI Assist for Customer from Deloitte. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.4%top 62.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.

Affected products (as reported)

Vendor	Product	Versions
Deloitte	AI Assist for Customer	0 – before 2026-03-25

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

url third-party-advisory
url third-party-advisory
url third-party-advisory
url vdb-entry