---
id: CVE-2026-73641
title: Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints
summary: >-
  Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An
  attacker can prepare a specially crafted URL that, when opened, results in
  arbitrary JavaScript execution in the victim's browser.


  This issue was fixed in ve…
severity: medium
cvss: 5.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'
cwe:
  - CWE-79
vendor: Dayforce
product: Payroll
affected:
  - Payroll R2026.2.0
published: '2026-09-28'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T14:17:39.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73641'
references:
  - url: 'https://cert.pl/en/posts/2026/09/CVE-2026-73640'
    label: cvd@cert.pl
  - url: 'https://hcm.excelityglobal.com/ESS'
    label: cvd@cert.pl
  - url: 'https://essportal.excelityglobal.com'
    label: cvd@cert.pl
  - url: 'https://cert.pl/en/posts/2026/08/CVE-2026-73640'
    label: cvd@cert.pl
  - url: 'https://www.dayforce.com/how-we-help/dayforce/payroll-solutions'
    label: cvd@cert.pl
tags:
  - nvd
  - cve.org
epss: 0.00327
epssPercentile: 0.25681
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-28T17:58:00.537549Z'
cvssSource: cna
ingestedAt: '2026-09-28T14:12:02.174Z'
---

## Overview

Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser.

This issue was fixed in version V4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.