Race Condition Vulnerability in SAP Commerce Cloud
CVE-2026-23684

5.9MEDIUM

Key Information:

Vendor

SAP

Vendor
CVE Published:
10 February 2026

What is CVE-2026-23684?

A race condition vulnerability exists in SAP Commerce Cloud that can be exploited during the product checkout process. When an attacker manipulates a cart by adding products, it may result in incorrect product values being recorded in the cart. This error can compromise the integrity of transaction data, leading to potential inconsistencies during checkout. While this impacts data integrity significantly, the integrity and availability of the application remain unaffected.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Affected Version(s)

SAP Commerce Cloud HY_COM 2205

SAP Commerce Cloud COM_CLOUD 2211

SAP Commerce Cloud 2211-JDK21

References

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.