CVE-2026-73641

UNKNOWN 0.0

Multiple Reflected XSS in Dayforce ESS Excelity

CVSS Score

0.0

EPSS Score

0.3%

EPSS Percentile

24th

Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version V4.

CWE	CWE-79
Vendor	dayforce
Product	ess excelity
Published	Sep 28, 2026
Last Updated	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for dayforce ess excelity

Be the first to know when new unknown vulnerabilities affecting dayforce ess excelity are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Dayforce / ESS Excelity

0 < V4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cert.pl: https://cert.pl/en/posts/2026/09/CVE-2026-73640 hcm.excelityglobal.com: https://hcm.excelityglobal.com/ESS

Credits

Dawid Dudek (4c1d8urn)