Is CVE-2026-73641 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73641 being exploited in the wild.

How severe is CVE-2026-73641?

Informational severity, published 28 September 2026.

Which products and versions are affected?

Dayforce Payroll R2026.2.0 and potentially others.

Is there a fix for CVE-2026-73641?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-73641 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-73641?

Check whether you run Dayforce Payroll at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73641: Dayforce Payroll reflected XSS in multiple endpoints

CVE-2026-73641 · Severity: info · Published 2026-09-28

Dayforce Payroll, a widely-used payroll processing platform trusted by millions of employees, contains a reflected cross-site scripting (XSS) vulnerability in multiple endpoints. An attacker can craft a malicious URL that, when opened by a victim, executes arbitrary JavaScript in their browser, potentially allowing theft of session credentials, payroll data, or other sensitive information.

Technologies: Dayforce Payroll. Vendors: Dayforce.

Quick answers

Is CVE-2026-73641 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73641 being exploited in the wild.
How severe is CVE-2026-73641?: Informational severity, published 28 September 2026.
Which products and versions are affected?: Dayforce Payroll R2026.2.0 and potentially others.
Is there a fix for CVE-2026-73641?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-73641 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-73641?: Check whether you run Dayforce Payroll at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Reflected XSS vulnerability exists in multiple endpoints of Dayforce Payroll, allowing an attacker to inject arbitrary JavaScript through specially crafted URLs. The vulnerability requires user interaction (clicking a malicious link) and affects at least version R2026.2.0; the full scope of affected versions is unknown due to unsuccessful vendor contact. Successful exploitation grants arbitrary code execution in the victim's browser context, enabling session hijacking, credential theft, and data exfiltration.

Affected products

Dayforce Payroll R2026.2.0 and potentially others

Timeline

2026-09-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.