CVE-2026-73641: Multiple Reflected XSS in Dayforce Payroll

Published Sep 28, 2026
·
Updated

Dayforce Payroll is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser.

Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version R2026.2.0 but may also affect other versions.

Affected Software

1 affected component
Dayforce Dayforce Payroll=R2026.2.0

Event History

Sep 28, 2026
CVE Published
via MITRE·01:12 PM
Data Sourced
via MITRE·01:12 PM
DescriptionWeakness
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What does an attacker need to exploit this issue?

The attacker needs to craft a malicious URL and induce a victim to open it. Successful exploitation executes arbitrary JavaScript in the victim's browser.

2

Which versions are known to be affected?

The issue has been confirmed only in Dayforce Payroll version R2026.2.0. Other versions may also be affected, but this has not been confirmed.

3

Is a vendor fix or mitigation available?

The available information does not identify a vendor fix or workaround. Vendor contact attempts were unsuccessful.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203