Vulnerability · Published Feb 10, 2026 · Assigned by sap
CVE-2026-23684Race condition vulnerability in SAP Commerce Cloud
Medium 5.9
In plain English
A medium-severity security flaw in SAP Commerce Cloud from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.2%top 91.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being created with erroneous product value which could be checked out. This leads to high impact on data integrity, with no impact on data confidentiality or availability of the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP Commerce Cloud | HY_COM 2205COM_CLOUD 22112211-JDK21 |
Weakness: CWE-366 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N