Poland's CERT could not reach Dayforce, and published three payroll flaws anyway
Poland's national CERT published three unauthenticated flaws in Dayforce Payroll on 28 September after vendor contact attempts failed, a week after the same product line cleared FedRAMP for US federal buyers and with Sydney Water workers entering a third month of missed pay. The $5.5 billion loan behind Thoma Bravo's buyout is priced on the idea that payroll is too risky to leave.
Vincent Jiang · 3 min read
On 28 September 2026, Poland's national CERT published advisories for three unauthenticated flaws in Dayforce Payroll after what it describes as unsuccessful attempts to contact the vendor 5.
The pay that never lands
Since July, the same product line inside Sydney Water has paid workers late or dropped the penalties and overtime hundreds of them rely on for rent and child support 1. At least half the utility's 3,000 staff have signed on to work bans and rolling stoppages, and the unions have taken the dispute to the Fair Work Commission and the NSW Industrial Relations Commission 1. "We're facing October and it still hasn't been fixed," ASU secretary Angus McFarland said 1. The system cost A$40 million and has already triggered four court actions 8.
A toll booth with debt attached
Thoma Bravo took Dayforce private in a $12.3 billion buyout shareholders backed, cashing stockholders out at $70 a share 23. What sits behind is a $5.5 billion first-lien term loan, rated B+, on a base of 85 percent recurring revenue and gross retention in the high 90s 4. Fitch expects leverage of 7.6x EBITDA this fiscal year, sliding below 7.0x within 12 to 18 months 4. The Inference tied this strike to that debt on 26 September; the week since has added two more turns.
Fitch's case for Dayforce's B rating: leverage sliding from above 8x toward 7x
- Adjusted EBITDA leverage
- Estimate
Data
| Adjusted EBITDA leverage | |
|---|---|
| Earlier FY26 view (estimate) | 8x |
| FY2026 forecast (estimate) | 7.6x |
| Outlook to late 2027 (estimate) | 7x |
Three keys, no answer
The advisories cover release R2026.2.0: a time-based blind SQL injection reachable through password recovery, cross-site scripting across multiple endpoints, and a path traversal that lets an unauthenticated attacker fetch any local file 5. Only that release is confirmed affected, and other versions may share the flaws 5.
Cleared for Washington a week earlier
On 21 September, Dayforce announced Initial Implementation status on the FedRAMP Marketplace, putting its payroll platform on the list US federal agencies can procure from, inside a dedicated government cloud 67. Fitch's rating rationale names the moat outright: auditability requirements and legal risk from payroll errors should limit disruption from AI tools 4. Legal risk from payroll errors is the thing Sydney Water's workers are carrying.
The other side
Sydney Water has apologised, added payroll staff, and is paying remediation and trust-based hardship advances 1. Dayforce points to continued investment in security controls and its record with regulated public sector bodies 6. Fitch's retention numbers have not budged 4.
What breaks first
Three doors: what the Fair Work Commission does with the Sydney Water dispute 1; whether Dayforce answers CERT Polska and patches R2026.2.0 5; and whether the leverage slide survives any churn it causes 4. The moat and the outage are the same machine: as long as payroll is too painful to leave, the loan gets serviced before the workers do.
How this brief was made
01Gathered & sourced300 channels · 1,055 articles▾
Agents swept 300 channels and ingested 1,055 articles, then de-duplicated and ranked them for signal.
02Verified & cross-validated8 claims · 28 data feeds▾
Every one of 8 load-bearing claims was checked against primary sources, with 28 live data feeds reconciling the figures and charts.
- 1ABC News (Australia), Sydney Water workers take industrial action over bungled payroll system rollout, 25 September 2026
- 2Infomarine On-Line Maritime News, Dayforce shareholders back Thoma Bravo's $12.3 billion take-private deal, undated
- 3AD HOC NEWS, Dayforce stock cashes out at $70 per share after merger, 19 August 2026
- 4Traders Union, Dayforce assigned 'B' IDR as Fitch sees leverage easing after Thoma Bravo deal, 25 September 2026
- 5CERT Polska, Vulnerabilities in Dayforce Payroll software (CVE-2026-73640/41/42), 28 September 2026
- 6Dayforce, Inc. press release via GlobeNewswire (Markets Insider), Dayforce Enters FedRAMP Marketplace, Marking Major Milestone in U.S. Federal Expansion, 21 September 2026
- 7Govly signal, Dayforce Enters FedRAMP Marketplace, Initial Implementation status as of 21 September 2026, collected 25 September 2026
- 8The Daily Telegraph, Sydney Water bosses urged to stand down as new $40m payroll system leaves staff unpaid, 28 August 2026 (paywalled; headline and teaser)
03Reviewed & edited1 human editor▾
One editor read the draft against the evidence, tuned the framing, and signed off before it shipped.
Become a contributor
Reporting on the business of AI and want it read? We take pitches from outside contributors who bring primary sources and a number worth arguing about.
Deepdive
AI-generated from this story and its cited sources. Not investment advice.
