CVE-2026-73640: Time-based SQL Injection in Dayforce Payroll
Dayforce Payroll is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in Time-Based Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version R2026.2.0 but may also affect other versions.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
No authentication is required. An attacker can send a crafted GET request to the password recovery functionality with a parameter containing an SQL query.
Which deployments are known to be affected?
The issue has been confirmed only in Dayforce Payroll version R2026.2.0. Other versions may also be affected, but this has not been confirmed.
How does exploitation work?
A vulnerable password-recovery request interprets an attacker-controlled parameter as part of an SQL predicate. The attacker can use response timing to infer information through blind SQL injection.