Dayforce Ess Excelity vulnerabilities

3 CVEs affecting Dayforce Ess Excelity, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-73642, published 2026-09-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-73642, published 2026-09-28. Critical severity, CVSS 9.2. EPSS: 0.4% chance of exploitation in the next 30 days. Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including…
CVE-2026-73641, published 2026-09-28. Medium severity, CVSS 5.1. EPSS: 0.3% chance of exploitation in the next 30 days. Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the…
CVE-2026-73640, published 2026-09-28. Critical severity, CVSS 9.3. EPSS: 0.3% chance of exploitation in the next 30 days. Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in…