Dayforce Payroll CVE-2026-73641

Exploitation requires the attacker to lure an authenticated Dayforce Payroll user into opening a specially crafted URL targeting one of the affected reflected-XSS endpoints (UI:A/UI:R) - the payload does not self-trigger. No attacker authentication is needed (PR:N) and default configurations are affected, but the mandatory victim click and the fact that impact is confined to the victim's browser session (no server-side compromise) are the key limiting factors. Confirmed only in Dayforce Payroll R2026.2.0; applicability to other versions is unverified because the vendor was unreachable.

This is a genuine but modest-priority issue - a real cross-site scripting flaw whose real-world risk is bounded by the interaction requirement, not inflated by it. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, 5.1 Medium) is internally consistent with a reflected XSS: network vector, no authentication (PR:N), but active user interaction (UI:A) is mandatory and there is NO vulnerable-system impact - only low subsequent-system confidentiality/integrity (SC:L/SI:L) representing script execution in the victim's browser. Exploitation status: no public exploit identified at time of analysis - there is no EPSS score, no CISA KEV listing, and no POC referenced in the CERT-PL advisory. All three signals therefore align on LOW likelihood of imminent mass exploitation; nothing conflicts here. The chief data gaps are that the flaw is confirmed ONLY in R2026.2.0 (vendor was unreachable, so the full affected-version range is unknown) and the sole reference URL actually points to sibling CVE-2026-73640 rather than this CVE, so endpoint-level detail is not independently verifiable. Net: a legitimate reflected XSS worth patching in a payroll/PII-handling SaaS, but not an emergency - it requires a socially-engineered click and yields session-scoped script execution rather than server compromise.

An attacker crafts a URL to a vulnerable Dayforce Payroll endpoint with a malicious JavaScript payload in a reflected parameter, then delivers it to a payroll user via phishing email or chat. When the victim (an authenticated HR/payroll operator) clicks the link, the script executes in their browser under the Dayforce origin, enabling session/token theft or actions in the payroll application on their behalf. No public POC or exploit code is currently available.