CVE-2026-73640 — Time-based SQL Injection in Dayforce ESS Excelity

CVE-2026-73640

Time-based SQL Injection in Dayforce ESS Excelity PUBLISHED

Description (CNA)

Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in Time-Based Blind SQL Injection. This issue was fixed in version V3.

Affected (CNA)

Vendor / product	Versions
Dayforce / ESS Excelity	affected 0 before V3

CWE

CWE-89

References

https://cert.pl/en/posts/2026/09/CVE-2026-73640
https://ess.Exceltiyglobal.com

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.