# CVE-2026-73642

Unauthenticated path traversal in Dayforce Payroll allows arbitrary local file download.

- Page: https://www.vulneraibility.com/cve/CVE-2026-73642
- CVSS: 9.2
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.42% (percentile 37.2)
- CISA SSVC: exploitation none, automatable yes, technical impact partial (assessed 2026-09-28)
- Weakness: CWE-22
- Published: 2026-09-28

## Affected versions

- Dayforce Payroll: affected R2026.2.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated attackers can download arbitrary local files (payroll records, configs, credentials), enabling data exfiltration and facilitating further compromise.

## Action

Immediate action required

## Recommendation

Block access to download endpoint, apply WAF rules, restrict public access, and deploy vendor patch when available; rotate exposed creds.

## References

- [advisory] https://cert.pl/en/posts/2026/09/CVE-2026-73640
- [other] https://hcm.excelityglobal.com/ESS

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.