CVE-2026-57474

Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accepted unauthenticated requests. This information could reduce an attacker’s reconnaissance effort. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-191-01.json	Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-57474	Third Party Advisory
https://zerotolerance.me/advisories/assets/VU487875-deloitte-ascend-advisory.pdf	Third Party Advisory
https://zerotolerance.me/advisories/deloitte-aiassist-ascend-2026-vu487875/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:deloitte:ai_assist_for_customer:*:*:*:*:*:*:*:*

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Deloitte AI Assist para Clientes reveló cierta información de configuración a través de puntos finales de API de cara al público que aceptaban solicitudes no autenticadas. Esta información podría reducir el esfuerzo de reconocimiento de un atacante. El 25 de marzo de 2026, AI Assist para Clientes restringió el acceso a la red y aplicó la autenticación para los puntos finales previamente expuestos.

Information

Published : 2026-07-10 18:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-57474

Mitre link : CVE-2026-57474

CVE.ORG link : CVE-2026-57474

JSON object : View

Products Affected

deloitte

ai_assist_for_customer

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-57474", "cveTags": [{"tags": ["exclusively-hosted-service"], "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725"}], "metrics": {"ssvcV203": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "ssvcData": {"id": "CVE-2026-57474", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T18:28:53.791135Z"}}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57474", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T17:06:37.456277Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "9119a7d8-5eab-497f-8521-727c672e3725", "affectedData": [{"vendor": "Deloitte", "product": "AI Assist for Customer", "versions": [{"status": "affected", "version": "0", "lessThan": "2026-03-25", "versionType": "custom"}, {"status": "unaffected", "version": "2026-03-25"}], "defaultStatus": "unknown"}]}], "published": "2026-07-10T18:16:24.657", "references": [{"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-191-01.json", "tags": ["Third Party Advisory"], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-57474", "tags": ["Third Party Advisory"], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://zerotolerance.me/advisories/assets/VU487875-deloitte-ascend-advisory.pdf", "tags": ["Third Party Advisory"], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}, {"url": "https://zerotolerance.me/advisories/deloitte-aiassist-ascend-2026-vu487875/", "tags": ["Third Party Advisory"], "source": "9119a7d8-5eab-497f-8521-727c672e3725"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9119a7d8-5eab-497f-8521-727c672e3725", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accepted unauthenticated requests. This information could reduce an attacker\u2019s reconnaissance effort. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints."}, {"lang": "es", "value": "Deloitte AI Assist para Clientes revel\u00f3 cierta informaci\u00f3n de configuraci\u00f3n a trav\u00e9s de puntos finales de API de cara al p\u00fablico que aceptaban solicitudes no autenticadas. Esta informaci\u00f3n podr\u00eda reducir el esfuerzo de reconocimiento de un atacante. El 25 de marzo de 2026, AI Assist para Clientes restringi\u00f3 el acceso a la red y aplic\u00f3 la autenticaci\u00f3n para los puntos finales previamente expuestos."}], "lastModified": "2026-10-25T15:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:deloitte:ai_assist_for_customer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49F64AE4-7B80-4D5B-9010-4D0246DA1A3D", "versionEndExcluding": "2026-03-25"}], "operator": "OR"}]}], "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725"}