Description
Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Deloitte AI Assist for Customer
Default version status: unknown
0 to < 2026-03-25affected2026-03-25unaffected
References
- https://zerotolerance.me/advisories/deloitte-aiassist-ascend-2026-vu487875/ ↗
- https://zerotolerance.me/advisories/assets/VU487875-deloitte-ascend-advisory.pdf ↗
- https://www.cve.org/CVERecord?id=CVE-2026-57475 ↗
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-191-01.json ↗