MyComplianceOffice MCO CVE-2026-53904

Exploitation requires two concrete prerequisites: the attacker must know the victim's registered email address in MCO, and must be able to correctly answer the victim's security question. The security question mechanism enforces a limited number of answer attempts, which means brute-forcing the question answer is constrained and the attacker likely needs prior knowledge of the answer (e.g., from social engineering, OSINT, or a separate data breach). Once those conditions are met, no authentication to MCO is required and no rate limit prevents continuous reset submission. The limiting factors are: the security question retry cap (reduces automated or blind exploitation), knowledge of the target's email (limits mass targeting), and correct security question answer (requires attacker-specific research per victim). Default configurations appear susceptible - no non-default feature flag or special deployment mode is described as required.

The CVSS 4.0 score of 6.3 with AV:N/AC:H/PR:N captures the threat accurately: the attack is remotely executable with no prior authentication, but attack complexity is genuinely high because the adversary must independently obtain the correct answer to the victim's security question - a fixed shared secret, but not publicly enumerable. The impact is purely on availability (VA:L at the vulnerable system level, SC/SI/SA all N), with no confidentiality or integrity loss. No KEV listing and no public POC exist at time of analysis, consistent with the relatively narrow exploitation window. The security question retry limit is a meaningful mitigating factor that substantially reduces the risk of automated or mass-scale exploitation. The primary realistic threat is a targeted attack against a specific high-value user by someone who already has partial knowledge of the victim - an insider, a social engineer, or a prior data-breach beneficiary. The vendor was unresponsive to CERT-PL's contact attempts, meaning no patch timeline is available; this raises the residual risk for organizations that cannot implement compensating controls. Overall this is a real but niche risk rather than a broad-exposure priority.

An attacker targeting a specific MCO user - for example, a compliance officer at a regulated financial firm - obtains the victim's email address and social-engineers or pre-knows the answer to their security question. The attacker submits repeated password reset requests via the MCO web interface; each reset silently invalidates the victim's current password and any active temporary credentials, locking the victim out instantly and re-locking them any time they recover. No public exploit code exists for this scenario, but it requires no specialized tooling beyond a browser or simple HTTP client.