CVE-2026-73641
Received Received - Intake

Reflected Cross-Site Scripting in Dayforce Payroll

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: CERT.PL

Description
Dayforce Payroll is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version R2026.2.0 but may also affect other versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-73641
EUVD
EUVD-2026-88250

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dayforce payroll r2026.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Dayforce Payroll has a reflected cross-site scripting (XSS) vulnerability in multiple endpoints. This means an attacker can craft a malicious URL that, when accessed by a victim, executes arbitrary JavaScript in their browser. The issue was confirmed in version R2026.2.0 but may affect other versions as well.

Detection Guidance

Detecting this Reflected XSS vulnerability requires manual testing of affected endpoints. Use browser developer tools to inspect network requests for suspicious parameters in URLs. Check for JavaScript execution by crafting test payloads like <script>alert(1)</script> in input fields or URL parameters. Monitor browser console for errors after submitting requests.

Impact Analysis

An attacker could exploit this to steal session cookies, redirect users to phishing sites, or perform actions on behalf of the user. It may lead to unauthorized data access, account takeover, or malware installation if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face fines or penalties for failing to address such risks.

Mitigation Strategies

Immediately apply vendor patches if available for version R2026.2.0. Implement input validation and output encoding on all user-supplied data. Use Content Security Policy (CSP) headers to mitigate XSS impact. Disable or restrict access to vulnerable endpoints until patched. Monitor network traffic for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73641. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart