CVE-2026-73641 — Multiple Reflected XSS in Dayforce ESS Excelity

CVE-2026-73641

Multiple Reflected XSS in Dayforce ESS Excelity PUBLISHED

Description (CNA)

Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version V4.

Affected (CNA)

Vendor / product	Versions
Dayforce / ESS Excelity	affected 0 before V4

CWE

CWE-79

References

https://cert.pl/en/posts/2026/09/CVE-2026-73640
https://hcm.excelityglobal.com/ESS

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.