# CVE-2026-53904: MyComplianceOffice MCO Account Denial of Service in password reset

Source: https://junglewise.ai/threats/cve-2026-53904-mycomplianceoffice-mco-account-denial-of-service-in-password  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-53904 · Severity: info · CVSS 6.3 · Published 2026-07-01

MyComplianceOffice (MCO) is a compliance management platform used by financial services and investment firms to manage regulatory obligations. A flaw in its password reset process allows an attacker to repeatedly lock legitimate users out of their accounts. By knowing a user's email and correctly guessing their security question, an attacker can trigger a reset that immediately invalidates the user's current password, causing a denial of service for that account.

Technologies: [MyComplianceOffice MCO](https://junglewise.ai/threats/technologies/mco). Vendors: [MyComplianceOffice](https://junglewise.ai/threats/vendors/mycomplianceoffice).

## Quick answers

**Is CVE-2026-53904 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53904 being exploited in the wild.

**How severe is CVE-2026-53904?** Informational severity, with a CVSS score of 6.3, published 1 July 2026.

**Which products and versions are affected?** MyComplianceOffice MCO 25.3.3.1.

**Is there a fix for CVE-2026-53904?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53904 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-53904?** Check whether you run MyComplianceOffice MCO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The MCO application (confirmed in version 25.3.3.1) suffers from an improper restriction of excessive authentication attempts (CWE-307) and a weak password recovery mechanism (CWE-640). The password reset logic is designed such that initiating a reset request immediately invalidates the user's current password and any previously issued temporary passwords. Because there is no rate limiting on these requests, an attacker who knows a victim's email and can answer their security question can continuously trigger resets to keep the victim locked out. While security questions have a limited number of attempts, a successful guess allows for persistent account denial of service. No patch is currently confirmed as vendor contact attempts were unsuccessful.

## Affected products

- MyComplianceOffice MCO 25.3.3.1

## Timeline

- 2026-07-01: disclosed: Disclosed by CERT.PL after unsuccessful vendor contact attempts.
- 2026-07-01: advisory

## References

- [https://cert.pl/en/posts/2026/07/CVE-2026-53902](https://cert.pl/en/posts/2026/07/CVE-2026-53902)
- [https://mco.mycomplianceoffice.com/](https://mco.mycomplianceoffice.com/)

## Related threats

- [MyComplianceOffice MCO Unrestricted File Upload](https://junglewise.ai/threats/cve-2026-53909-mycomplianceoffice-mco-unrestricted-file-upload)
- [MyComplianceOffice MCO user enumeration in authentication components](https://junglewise.ai/threats/cve-2026-53908-mycomplianceoffice-mco-user-enumeration-in-authentication)
- [MyComplianceOffice MCO Stored XSS in logo upload](https://junglewise.ai/threats/cve-2026-53907-mycomplianceoffice-mco-stored-xss-in-logo-upload)
- [MyComplianceOffice MCO path traversal and path disclosure in file handling](https://junglewise.ai/threats/cve-2026-53906-mycomplianceoffice-mco-path-traversal-and-path-disclosure-in-file)
- [MyComplianceOffice MCO Incorrect Authorization in ACL Tree Endpoint](https://junglewise.ai/threats/cve-2026-53905-mycomplianceoffice-mco-incorrect-authorization-in-acl-tree)