EUVD-2026-42976
GHSA-85qw-gwgm-xj6w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N as endpoints are network-reachable; AC:H because specific undocumented parameter knowledge is required; C:L/I:L for partial corpus read and injection; no availability impact.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
3DescriptionCVE.org
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.
AnalysisAI
Unauthenticated API endpoints in Deloitte AI Assist for Customer exposed the platform's retrieval-augmented generation corpus to unauthorized read access and content injection by any network-reachable attacker who could discover the required request parameters. The root cause is missing authentication on critical internal API functions (CWE-306), enabling adversaries to exfiltrate proprietary knowledge base content or poison AI-generated responses with injected documents. The vendor applied a server-side fix on 2026-03-25 by restricting network access and enforcing authentication; no public exploit code or CISA KEV listing has been identified, though an independent security advisory has been published.
Technical ContextAI
Deloitte AI Assist for Customer is an enterprise AI platform built on a retrieval-augmented generation (RAG) architecture, where LLM responses are grounded by querying a curated document corpus at inference time. The vulnerable API endpoints mediated both read and write access to this RAG corpus but lacked authentication controls, as classified under CWE-306 (Missing Authentication for Critical Function). The CPE string cpe:2.3:a:deloitte:ai_assist_for_customer:*:*:*:*:*:*:*:* with no version bounds indicates all tracked releases were potentially affected prior to the vendor's server-side remediation. Beyond conventional data exfiltration, exploitation of unauthenticated RAG corpus write access introduces corpus poisoning as a threat vector - injected content can skew AI outputs for all downstream users in ways that are difficult to detect and may persist until the corpus is audited and cleaned.
RemediationAI
The vendor applied a server-side fix on 2026-03-25 by restricting network access to the previously exposed RAG corpus API endpoints and enforcing authentication on all previously unauthenticated routes. As AI Assist for Customer appears to be a hosted/SaaS platform, there is no client-side software version to upgrade; organizations should contact Deloitte to confirm their deployment received the fix and request verification that all API endpoints now require authentication. Refer to the independent advisory at https://zerotolerance.me/advisories/deloitte-aiassist-ascend-2026-vu487875/ and the CISA CSAF file for additional technical detail. As a compensating control where fix confirmation is pending, restrict network-layer access to the AI Assist for Customer API surface via firewall rules or network segmentation - this mirrors the vendor's own remediation approach but does not address the underlying missing authentication defect; it should be treated as temporary. Additionally, audit the RAG corpus for any unauthorized or anomalous content injection that may have occurred prior to 2026-03-25.
More in Ai Assist For Customer
View allDeloitte AI Assist for Customer exposed public-facing REST API endpoints that accepted unauthenticated POST requests, en
Configuration information disclosure in Deloitte AI Assist for Customer exposed internal system details through unauthen
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today