CVE-2026-57476: Ai Assist For Customer: kritik işlevde kimlik doğrulaması eksik

Açıklama (NVD)

Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.

Özet bilgiler

Ürün

Deloitte Ai Assist For Customer

CVSS v3.1

4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CVSS v4.0

6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

%0,44 (yüzdelik 38)

CWE

CWE-306

Yama

Yok / bilinmiyor

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• raw.githubusercontent.com
• www.cve.org
• zerotolerance.me
• zerotolerance.me
• CWE-306