MyComplianceOffice MCO CVE-2026-53908

No special conditions are required for exploitation: MCO's password reset and username reminder endpoints are publicly accessible by design to support unauthenticated self-service account recovery, and the CVSS 4.0 vector (PR:N, UI:N, AC:L) confirms no privileges, user interaction, or elevated complexity are needed. The distinguishable response discrepancy is the exploitable condition - the attacker need only observe differing application outputs for valid versus invalid account queries. Exploitation is constrained by: (1) the attacker must have network access to the MCO instance, which is typically internet-facing for SaaS deployments; (2) rate limiting or CAPTCHA controls, if present, would increase effort required but are not confirmed as default MCO defenses; (3) the impact is limited to account enumeration - no credentials are exposed, and further exploitation requires a separate attack phase such as phishing or credential stuffing against the enumerated accounts.

The CVSS 4.0 score of 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N reflects trivially automatable, unauthenticated network exploitation, but the impact metrics (VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) correctly constrain this to low-confidence reconnaissance - no system compromise, data exfiltration, or availability disruption results directly. The real-world risk is contextual: MCO serves compliance officers, legal, HR, and executive stakeholders in regulated industries, making enumerated account lists high-value targets for spear-phishing and business email compromise rather than mass exploitation. No CISA KEV listing and no confirmed POC code reduce urgency, but the zero-friction attack conditions (no auth, no complexity, fully automated) mean the barrier to abuse is extremely low. The absence of a vendor patch and unsuccessful vendor contact - explicitly noted by CERT-PL - means the exposure window is open-ended with no official remediation timeline. EPSS data was not provided in the input; exploitation probability cannot be quantified numerically. Key uncertainty: version scope beyond 25.3.3.1 is unconfirmed due to failed vendor engagement.

An unauthenticated attacker scripts HTTP POST requests to MCO's publicly accessible password reset and username reminder endpoints, submitting a wordlist of email addresses or usernames. By parsing the distinct application responses - differing message text, HTTP status codes, or redirect targets - the attacker automatically classifies each input as a valid or invalid account, producing a clean list of confirmed MCO users. This validated account roster is then handed off to a phishing or credential stuffing campaign targeting compliance officers and executives whose MCO access implies sensitive regulatory responsibilities.