Dayforce Payroll CVE-2026-73640

No special conditions - remote unauthenticated exploitation of the Dayforce Payroll password-recovery (forgot-password) functionality, reachable via a crafted GET request against default deployments. The only stated prerequisite is network access to the password-recovery endpoint; no authentication, credentials, or user interaction is required. Limiting factors: exploitation is time-based blind, so it requires many timed requests and is slower and more detectable than direct data exfiltration; confirmation is limited to version R2026.2.0 (other versions unverified), and much of Dayforce is vendor-hosted SaaS, which narrows the set of independently exploitable targets. No vendor fix is available, so mitigation depends on WAF/rate-limiting rather than patching.

This is a genuine high-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction, and CWE-89 SQL injection against a payroll/HCM backend directly threatens confidentiality (VC:H) and integrity (VI:H) of highly sensitive employee and financial data. No EPSS score, KEV listing, or public POC is present in the input, so there is NO confirmed active exploitation and no evidence of automated mass exploitation yet - the danger is potential rather than demonstrated. A critical aggravating factor overrides the missing-POC comfort: CERT-PL states vendor contact attempts were unsuccessful, so there is no confirmed patch, meaning affected deployments cannot simply update. The time-based blind technique makes exploitation slower and noisier (many requests to infer data bit-by-bit), which modestly tempers real-world ease compared to error/union-based SQLi, but does not eliminate risk. Net: treat as a real priority driven by unauthenticated network reach plus absent fix, while acknowledging exploitation is not yet observed in the wild.

An unauthenticated attacker sends a crafted GET request to the Dayforce Payroll password-recovery endpoint, placing a boolean/time-delay SQL expression into a vulnerable parameter that is concatenated into a SQL predicate. By measuring server response delays, they infer database contents character-by-character, extracting credentials, password-reset tokens, and payroll/PII records. No public exploit code is identified in the provided data, but the technique is standard and readily automatable with tools like sqlmap.