CVE-2026-73640 PUBLISHED

Time-based SQL Injection in Dayforce Payroll

Assigner: CERT-PL
Reserved: 13.08.2026 Published: 28.09.2026 Updated: 28.09.2026

Dayforce Payroll is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in Time-Based Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version R2026.2.0 but may also affect other versions.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 9.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	Dayforce
Product	Payroll
Versions	Default: unknown Version R2026.2.0 is affected

Credits

Dawid Dudek (4c1d8urn) finder

References

Problem Types

CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') CWE

Impacts

CAPEC-66 SQL Injection