CVE-2026-73641

Deferred Deferred - Pending Action

Reflected Cross-Site Scripting in Dayforce Payroll

Publication date: 2026-09-28

Last updated on: 2026-10-13

Assigner: CERT.PL

Description

Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version V4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-10-13

Generated

2026-10-18

AI Q&A

2026-09-28

EPSS Evaluated

2026-10-16

NVD

CVE-2026-73641

EUVD

EUVD-2026-88250

Affected Vendors & Products

Vendor	Product	Version / Range
dayforce	payroll	r2026.2.0
dayforce	payroll	From r2026.2.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Dayforce Payroll has a reflected cross-site scripting (XSS) vulnerability in multiple endpoints. This means an attacker can craft a malicious URL that, when accessed by a victim, executes arbitrary JavaScript in their browser. The issue was confirmed in version R2026.2.0 but may affect other versions as well.

Detection Guidance

Detecting this Reflected XSS vulnerability requires manual testing of affected endpoints. Use browser developer tools to inspect network requests for suspicious parameters in URLs. Check for JavaScript execution by crafting test payloads like <script>alert(1)</script> in input fields or URL parameters. Monitor browser console for errors after submitting requests.

Impact Analysis

An attacker could exploit this to steal session cookies, redirect users to phishing sites, or perform actions on behalf of the user. It may lead to unauthorized data access, account takeover, or malware installation if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face fines or penalties for failing to address such risks.

Mitigation Strategies

Immediately apply vendor patches if available for version R2026.2.0. Implement input validation and output encoding on all user-supplied data. Use Content Security Policy (CSP) headers to mitigate XSS impact. Disable or restrict access to vulnerable endpoints until patched. Monitor network traffic for unusual activity.

Hi! I’m here to help you understand CVE-2026-73641. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70