CVE-2026-23684 MEDIUM

CVE-2026-23684: Race condition vulnerability in SAP Commerce Cloud

Vendor Sap_Se
Product SAP Commerce Cloud
Weakness CWE-366
Published February 10, 2026
Last update February 10, 2026
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being created with erroneous product value which could be checked out. This leads to high impact on data integrity, with no impact on data confidentiality or availability of the application.

Key dates

02Disclosure timeline

February 10, 2026 CVE published
February 10, 2026 Record updated