CVE-2026-73640 describes an improper neutralization of special elements used in an SQL command (CWE-89) in Dayforce Payroll. The flaw exists in the password recovery feature where an unauthenticated attacker can inject arbitrary SQL code via a GET request parameter. This leads to a time-based blind SQL injection vulnerability, allowing attackers to infer data from the backend database by measuring response delays. Attempts to contact the vendor were unsuccessful, and the vulnerability is confirmed only in version R2026.2.0 but may affect other versions as well.

Successful exploitation allows an unauthenticated attacker to perform time-based blind SQL injection, potentially leading to unauthorized data disclosure or manipulation within the payroll system database. Given the critical CVSS score of 9.3 and the unauthenticated remote attack vector, this vulnerability poses a high risk to confidentiality and integrity of sensitive payroll data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the password recovery functionality if possible and monitor for suspicious activity targeting this feature.