PT-2026-54834 · Mco · Mco

Hubert Decyusz · Published 2026-07-01 · Updated 2026-07-06 · CVE-2026-53908

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MCO version 25.3.3.1

Description The application is susceptible to user enumeration via authentication-related features. During password reset and username reminder operations, the system provides different responses depending on whether the user is valid or invalid. This behavior allows an attacker to identify and compile lists of valid usernames and email addresses.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2026-53908

Affected Products

Mco

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-53908 · Security Note
• https://twitter.com/infoflowcloud/status/2072325827539153030 · Twitter Post
• https://t.me/cveNotify/188713 · Telegram Post
• https://cert.pl/en/posts/2026/07/CVE-2026-53902 · Note
• https://t.me/cveNotify/183676 · Telegram Post
• https://twitter.com/CVEnew/status/2072324844159381974 · Twitter Post
• https://mco.mycomplianceoffice.com · Note