Critical severity · published Sep 28, 2026
CVE-2026-73640
Time-based SQL Injection in Dayforce ESS Excelity
9.3
CVSS
0.3%
EPSS
No
On KEV
Description
Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in Time-Based Blind SQL Injection.
This issue was fixed in version V3.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EE
ESS Excelity · Dayforce
before V3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73640
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73640
third-party-advisory
https://cert.pl/en/posts/2026/09/CVE-2026-73640
product
https://ess.Exceltiyglobal.com
More from ESS Excelity
9.2
CVE-2026-73642
Path Traversal in Dayforce ESS Excelity
5.1
CVE-2026-73641
Multiple Reflected XSS in Dayforce ESS Excelity