# CVE-2026-73640: Dayforce Payroll time-based blind SQL injection in password recovery

Source: https://junglewise.ai/threats/cve-2026-73640-dayforce-payroll-is-vulnerable-to-time-based-blind-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-73640 · Severity: info · Published 2026-09-28

Dayforce Payroll is a cloud-based payroll processing system used to manage employee compensation and benefits for millions of users. An unauthenticated attacker can exploit a SQL injection vulnerability in the password recovery function by sending a specially crafted web request, allowing them to extract sensitive data from the payroll database without authentication credentials. This exposure could lead to unauthorized access to employee personal information, payroll records, and other confidential business data.

Technologies: [Dayforce Payroll](https://junglewise.ai/threats/technologies/dayforce-payroll). Vendors: [Dayforce](https://junglewise.ai/threats/vendors/dayforce).

## Quick answers

**Is CVE-2026-73640 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73640 being exploited in the wild.

**How severe is CVE-2026-73640?** Informational severity, published 28 September 2026.

**Which products and versions are affected?** Dayforce Payroll R2026.2.0 and potentially other versions.

**Is there a fix for CVE-2026-73640?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-73640 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-73640?** Check whether you run Dayforce Payroll at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Time-Based Blind SQL Injection vulnerability exists in the password recovery functionality where GET request parameters are not properly sanitized before being used in SQL predicates. An unauthenticated attacker can inject arbitrary SQL code through GET parameters to exfiltrate data using timing-based inference techniques. No patch has been confirmed from the vendor as disclosure attempts were unsuccessful; the vulnerability is confirmed in version R2026.2.0 and may affect other versions.

## Affected products

- Dayforce Payroll R2026.2.0 and potentially other versions

## Timeline

- 2026-09-28: disclosed: CERT Polska published CVE-2026-73640

## References

- [https://cert.pl/en/posts/2026/09/CVE-2026-73640](https://cert.pl/en/posts/2026/09/CVE-2026-73640)
- [https://www.dayforce.com/how-we-help/dayforce/payroll-solutions](https://www.dayforce.com/how-we-help/dayforce/payroll-solutions)

## Related threats

- [Dayforce Payroll path traversal in file download](https://junglewise.ai/threats/cve-2026-73642-dayforce-payroll-is-vulnerable-to-path-traversal-in-file-download)
- [Dayforce Payroll reflected XSS in multiple endpoints](https://junglewise.ai/threats/cve-2026-73641-dayforce-payroll-is-vulnerable-to-reflected-xss-in-multiple)