CVE-2026-53904: MCO Password Reset Denial of Service Vulnerability (CVSS 7.1)

Technical summary

CVE-2026-53904 is rooted in improper implementation of password reset functionality in MCO version 25.3.3.1. The vulnerability stems from insufficient rate limiting and credential invalidation logic (CWE-307: Improper Restriction of Rendered UI Layers or Frames, and CWE-640: Weak Password Recovery Mechanism for Forgotten Password). When a password reset is initiated and validated, the system invalidates not only the existing password but also any outstanding temporary reset passwords. More critically, there is no constraint on the frequency or total number of reset requests an authenticated attacker can initiate. An attacker with knowledge of the victim's email and security question answer can repeatedly invoke password resets, effectively keeping the victim's credentials in a perpetually invalid state and preventing legitimate access.

Business impact

Account lockout attacks degrade user experience and support costs. Affected users cannot access their compliance data and workflows, potentially creating operational delays for regulated organizations that depend on MCO for compliance tracking and reporting. While the attack requires the attacker to know or guess the security question answer, the unlimited reset capability means a single successful breach of that information leads to persistent account denial. For organizations using MCO, this creates a support burden and potential compliance gaps if users cannot complete required compliance activities.

Affected systems

MCO version 25.3.3.1 is confirmed vulnerable. The vendor confirmation status for other versions is unknown due to unsuccessful vendor contact attempts, so the scope of affected versions remains unclear. Organizations running MCO should determine their deployed version and assess whether they are on 25.3.3.1 or a version that may share the same password reset logic.

Exploitability

The attack requires prior knowledge or correct answering of the victim's security question, which introduces friction. MCO implements a limited number of allowed incorrect answers to security questions, reducing the feasibility of brute-forcing this component. However, once an attacker successfully answers the security question (via social engineering, credential stuffing from prior breaches, or other means), the unlimited password reset requests can be automated and require no further user interaction. The attack is remotely exploitable and requires only network access—no authenticated session is necessary to initiate a password reset. CVSS score of 7.1 reflects the high availability impact (account denial) tempered by the requirement for an initial authentication factor (security question answer).

Remediation

Implement rate limiting on password reset requests per email address or per account, such as a maximum of one reset request per 15–60 minutes or a daily cap on total resets. Modify the credential invalidation logic so that only the current password is invalidated upon reset initiation; temporary reset tokens should remain valid until explicitly used or expire naturally. Enforce stricter security question policies: increase entropy of answers, rotate questions periodically, or supplement with additional verification (e.g., email confirmation). Contact MCO to verify patch availability for version 25.3.3.1 and any other affected versions. Test patches in a non-production environment before deployment.

Patch guidance

Verify the current MCO version in your environment. Check MCO's security advisory or update portal for patches addressing CVE-2026-53904. If running version 25.3.3.1 or another version within the affected range, prioritize the installation of any available patch. Because vendor contact was unsuccessful at the time of CVE publication, monitor MCO's security page and your vendor notifications closely for patch release information. If no patch is immediately available, consider implementing compensating controls: rate-limit password reset requests at your network perimeter or application layer, enforce multi-factor authentication to add a recovery barrier, and monitor reset request logs for anomalous patterns.

Detection guidance

Monitor logs for multiple failed security question attempts from the same IP or user context, which may indicate reconnaissance. Look for unusual spikes in password reset requests for a single account within a short time window—legitimate users rarely reset passwords more than once or twice per day. If your MCO instance logs password reset events with timestamps and requester IP, correlate rapid-fire reset requests with user complaints of unexplained lockouts. Implement alerting on security question failures followed by successful reset attempts. If available, enable verbose password reset auditing and review for accounts that experience repeated resets without corresponding user support tickets.

Why prioritize this

This vulnerability should be prioritized due to its direct impact on user availability and its requirement for minimal attacker sophistication once a security question answer is obtained. The CVSS score of 7.1 (HIGH) reflects significant availability impact. While the attack does not affect confidentiality or integrity of data and requires some initial authentication, the unlimited nature of resets and ease of automation make this a practical denial-of-service vector. For organizations managing compliance workflows, account lockouts can cascade into missed compliance deadlines and regulatory exposure. The fact that vendor contact was unsuccessful suggests patch availability and timeline are uncertain, making rapid internal detection and compensating controls critical.

Risk score, explained

CVSS v3.1 score of 7.1 (HIGH) is calculated as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H. The score reflects: Network Attack Vector (AV:N) for remote exploitability; Low Attack Complexity (AC:L) because no special conditions or timing are required; a privilege level (PR:L) because the attacker must successfully answer the security question, a form of user-level authentication; No User Interaction (UI:N) once the reset is triggered; Unchanged Scope (S:U) and high Availability impact (A:H) because legitimate users are locked out. The Low Confidentiality impact (C:L) is typically scored conservatively for account-based attacks where some sensitive data may be exposed during the account recovery process.

Frequently asked questions