EUVD-2026-88251
GHSA-p8m3-fq83-fgm7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Dayforce Payroll download endpoint
-
ExploitSend GET with absolute path in file-path param
-
ExecutionServer reads arbitrary local file
-
ImpactExfiltrate payroll data, PII and secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation of the file-download functionality in Dayforce Payroll: the attacker supplies an absolute or traversal file path in the download GET parameter and the server returns arbitrary local file contents. The only limiting factors are network reachability of the vulnerable endpoint and the confirmed-affected version R2026.2.0 (other versions unconfirmed because the vendor was unreachable); no authentication, user interaction, or non-default configuration is required. |
| Impact | This scores CVSS 4.0 9.2 (vendor/NVD) with a fully remote, unauthenticated, low-complexity vector (AV:N/AC:L/PR:N/UI:N) and high confidentiality impact including a subsequent-system scope change (SC:H) - an unauthenticated path traversal that reads arbitrary local files (payroll records, PII, credentials, config secrets) is a genuine high priority on paper. However, the real-risk signals are thin: EPSS is not provided, the CVE is NOT in CISA KEV, and no public POC is identified, so this is 'no public exploit identified at time of analysis' rather than confirmed exploitation. The confidentiality-only impact (VI:N/VA:N) means no direct integrity or availability loss, but arbitrary file read of a payroll platform is inherently severe. A key caveat: the vulnerability was confirmed ONLY in version R2026.2.0 because vendor contact failed, so the true affected-version range and patch status are unknown - treat 'may also affect other versions' as unverified. The single reference URL points to a sibling advisory (CVE-2026-73640), so primary-source corroboration for THIS CVE is weak. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted GET request to the file-download endpoint with the file-path parameter set to an absolute local path (e.g. a system config or payroll data file), and the server returns the file contents. Because no authentication or user interaction is required (PR:N/UI:N), this can be automated against exposed instances; no public POC is currently identified, but the class is trivial to weaponize. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Remote, unauthenticated attackers can retrieve arbitrary local files from Dayforce Payroll by calling its file-download functionality with an absolute path or directory-traversal sequence in the file path parameter, with the server returning the file contents directly in the response. The issue is scored CVSS 4.0 9.2 (vendor/NVD) - network-reachable, low complexity, no privileges or user interaction required, high confidentiality impact, and a scope change to subsequent systems - making payroll data, PII, credentials and configuration secrets the realistic target set. Because vendor contact attempts were unsuccessful, only version R2026.2.0 is confirmed affected and the full version range remains unknown; no public exploit code has been identified at time of analysis.
RemediationAI
No vendor-released patch has been identified at time of analysis: the CVE record states that vendor contact attempts were unsuccessful, so no fixed version number exists to upgrade to and the mitigation burden currently falls entirely on defenders. Until Dayforce issues an advisory, the most effective compensating control is to block unauthenticated network reachability of the file-download endpoint - front it with authentication plus per-file authorization checks, or restrict it to trusted source networks/VPN. Deploying WAF or reverse-proxy rules that reject requests whose file path parameter contains ../ or begins with / (the absolute-path and traversal forms described) reduces trivial attempts, but because encoded and alternate traversal encodings can bypass signature-based filters, this must be treated as partial, defense-in-depth only rather than a fix. Where the application is self-managed, run the download service under a least-privilege OS account and jail/containerize it so that traversal can only expose files the service already owns - side effect: legitimate downloads of files outside that sandbox will break and must be migrated into it. Enable and monitor web/application logs for file-path parameters containing traversal or absolute paths and for abnormal 200 responses to download requests, and rotate any credentials or secrets stored in files reachable by the service since arbitrary read must be assumed once an endpoint is exposed. Watch the CERT-PL advisory at https://cert.pl/en/posts/2026/08/CVE-2026-73640 and the Dayforce Payroll product page at https://www.dayforce.com/how-we-help/dayforce/payroll-solutions for a fixed release, then upgrade to the exact vendor-published version rather than assuming the current release is safe.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal) in the file-download handler of the Dayforce Payroll application. The GET-based download endpoint accepts a caller-supplied file path and fails to canonicalize and constrain it to an intended base directory: it neither normalizes away ../ sequences nor rejects absolute paths, so the reconstructed filesystem path resolves outside the intended download root. Historically, defenses against this pattern are an allowlist of downloadable file identifiers, canonicalization (realpath) followed by a strict prefix check against a fixed root, and running the service under a least-privilege account. The CVSS 4.0 vector shows PR:N and UI:N, meaning the vulnerable endpoint is reachable without authentication; the SC:H (subsequent system confidentiality: High) metric, echoed by the independent CVSS 3.1 assessment (S:C/C:H/I:N/A:N), indicates the attacker reads data beyond the vulnerable component's own authorization boundary - consistent with a multi-tenant payroll platform where files served may belong to other tenants or contain secrets. The CPE entry cpe:2.3:a:dayforce:payroll:*:*:*:*:*:*:*:* uses a wildcard version, so it provides no version scoping; only R2026.2.0 has been tested and confirmed.
Know when Payroll gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Unauthenticated remote arbitrary file read via HTTP (AV:N/AC:L/PR:N/UI:N); reading OS files beyond the app security authority gives S:C with C:H, and no write/DoS so I:N/A:N.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
DescriptionCVE.org
Dayforce Payroll is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version R2026.2.0 but may also affect other versions.
Executive ViewAI
Dayforce Payroll, a system processing employee compensation, tax identifiers, and banking details, is affected by a critical unauthenticated file-disclosure vulnerability (CVE-2026-73642, CVSS 9.2). A remote attacker with no credentials could retrieve arbitrary files from the payroll server, exposing employee PII, payroll records, and stored application credentials directly in the response. Because the vulnerability is confirmed only in version R2026.2.0 and the vendor has not been responsive, leadership should treat exposure as open-ended until the full affected version range is established and a fix is obtained.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability of the Dayforce Payroll file-download endpoint to trusted sources; enforce WAF or reverse-proxy rules that reject absolute paths and directory-traversal sequences in the file path parameter; apply strict input allowlisting for legitimate document identifiers; segment the payroll application from general corporate networks; log and monitor the endpoint for traversal attempts; and rotate credentials or secrets that may reside on or be retrievable from the affected host.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Unauthenticated time-based blind SQL injection in the Dayforce Payroll password-recovery (forgot-password) function lets
Full compromise of Oracle Payroll (Oracle E-Business Suite, Internal Operations component) is possible when a low-privil
Full takeover of Oracle Payroll (component: Internal Operations) in Oracle E-Business Suite 12.2.3 through 12.2.15 is ac
Full compromise of Oracle Payroll (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.
Local privilege escalation in Oracle Payroll (E-Business Suite 12.2.3 through 12.2.15) enables a low-privileged attacker
Cross-scope confidentiality compromise in Oracle Payroll (Oracle E-Business Suite, Internal Operations component) versio
Unauthorized data exposure in Oracle Payroll (E-Business Suite component: Internal Operations) allows a low-privileged,
Unauthorized disclosure of critical data in Oracle Payroll (Oracle E-Business Suite, Internal Operations component), ver
Full compromise of Oracle Payroll (a module of Oracle E-Business Suite, Internal Operations component) is possible in su
Vulnerability in the Oracle Payables component of Oracle E-Business Suite (subcomponent: Self Service Manager). Rated me
Unauthorized data access in Oracle Payroll (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a low-pri
Local privilege escalation via authentication bypass in Oracle Payroll (E-Business Suite) versions 12.2.3 through 12.2.1
Exploit-DB