CVE-2026-73642 Dayforce CVE debrief

Who should care

Defenders and administrators of Dayforce ESS Excelity should assess exposure and prioritize remediation due to the critical severity of the vulnerability. Affected operators, platforms, and security teams must review vulnerability management and verify inventory for affected versions. The critical CVSS score of 9.2 and potential for unauthenticated file downloads necessitate prompt action and coordination among security teams, operators, and administrators

Why it matters

CVE-2026-73642 is a critical path traversal vulnerability in Dayforce ESS Excelity, allowing unauthenticated file downloads. Defenders should assess exposure, prioritize remediation, and verify inventory for affected versions.

• Verify inventory for affected Dayforce ESS Excelity versions
• Prioritize remediation for versions prior to V4
• Monitor for potential exploitation attempts

Technical summary

Dayforce ESS Excelity is vulnerable to path traversal, allowing unauthenticated attackers to download arbitrary local files. The issue was fixed in version V4. Defenders should assess exposure, prioritize remediation, and verify inventory for affected versions, focusing on critical CVSS score of 9.2 and potential operational impacts. The vulnerability allows attackers to manipulate file path parameters for unauthorized file access, emphasizing the need for version verification and prompt remediation. Affected operators and security teams should review source-grounded technical framing for defensive impact.

Defensive priority

High priority for version verification and remediation due to critical CVSS score of 9.2.

Recommended defensive actions

• Verify inventory for Dayforce ESS Excelity versions prior to V4
• Prioritize remediation for affected versions
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

Official CVE Program and NVD records confirm the path traversal vulnerability in Dayforce ESS Excelity, with a CVSS score of 9.2. The issue was fixed in version V4. Defenders should verify inventory, assess exposure, and prioritize remediation based on the critical severity. Evidence limits suggest focusing on confirmed affected versions and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.