CVE-2026-57474
Full vulnerability record from the local CVENow database.
Description
Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accepted unauthenticated requests. This information could reduce an attacker’s reconnaissance effort. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.
Severity
MEDIUM
CVSS score
6.9
(v4.0)
Vulnerability status
Analyzed
Source identifier
9119a7d8-5eab-497f-8521-727c672e3725
Published
2026-07-10 18:16:24.657000
Last modified
2026-10-25 15:10:00.147000
View original CVE JSON
{
"id": "CVE-2026-57474",
"sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725",
"published": "2026-07-10T18:16:24.657",
"lastModified": "2026-10-25T15:10:00.147",
"vulnStatus": "Analyzed",
"cveTags": [
{
"sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"exclusively-hosted-service"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accepted unauthenticated requests. This information could reduce an attacker’s reconnaissance effort. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints."
},
{
"lang": "es",
"value": "Deloitte AI Assist para Clientes reveló cierta información de configuración a través de puntos finales de API de cara al público que aceptaban solicitudes no autenticadas. Esta información podría reducir el esfuerzo de reconocimiento de un atacante. El 25 de marzo de 2026, AI Assist para Clientes restringió el acceso a la red y aplicó la autenticación para los puntos finales previamente expuestos."
}
],
"affected": [
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"affectedData": [
{
"vendor": "Deloitte",
"product": "AI Assist for Customer",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "2026-03-25",
"versionType": "custom",
"status": "affected"
},
{
"version": "2026-03-25",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"ssvcData": {
"timestamp": "2026-06-23T18:28:53.791135Z",
"id": "CVE-2026-57474",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-21T17:06:37.456277Z",
"id": "CVE-2026-57474",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:deloitte:ai_assist_for_customer:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2026-03-25",
"matchCriteriaId": "49F64AE4-7B80-4D5B-9010-4D0246DA1A3D"
}
]
}
]
}
],
"references": [
{
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-191-01.json",
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57474",
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://zerotolerance.me/advisories/assets/VU487875-deloitte-ascend-advisory.pdf",
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
},
{
"url": "https://zerotolerance.me/advisories/deloitte-aiassist-ascend-2026-vu487875/",
"source": "9119a7d8-5eab-497f-8521-727c672e3725",
"tags": [
"Third Party Advisory"
]
}
]
}