CVE-2026-57476: Deloitte Ai Assist For Customer

Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.

Affected products

• Deloitte Ai Assist For Customer: before 2026-03-25 (fixed in 2026-03-25)

Published 2026-07-10. Last modified 2026-08-03.