CVE-2026-73641 is a reflected XSS vulnerability (CWE-79) in Dayforce Payroll, confirmed in version R2026.2.0. The vulnerability arises from improper neutralization of input during web page generation, enabling attackers to execute arbitrary JavaScript via specially crafted URLs. Vendor contact attempts failed, and no patch or official advisory is currently available. The CVSS 4.0 base score is 5.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation allows execution of arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, information disclosure, or other client-side impacts. There is no evidence of active exploitation in the wild. The vulnerability affects user interaction scenarios where victims open malicious URLs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since vendor contact attempts were unsuccessful and no patch is available, users should exercise caution when clicking untrusted links related to Dayforce Payroll R2026.2.0. Monitor official vendor channels for updates.