VulnerabilityPublished 10 Feb 2026

CVE-2026-23684: SAP Commerce Cloud · Race Condition Within a Thread

Affects SAP Commerce CloudSource CVE Database V5

Not known to be exploited · CVSS 5.9 Medium.

Data as of 26 Oct 2026, 15:59 UTC

CVSS 3.1 base score

5.9Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.1% chance of exploitation in 30 days – higher than 8% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: High: A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected. For example, a successful attack may require an attacker to: gather knowledge about the environment in which the vulnerable target/component exists; prepare the target environment to improve exploit reliability; or inject themselves into the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications (e.g., a man in the middle attack).
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 10 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
SAP_SESAP Commerce Cloud	Affected =2211-JDK21	Fixed in–

AI-suggested

Monitor SAP's official channels for patches addressing CVE-2026-23684 and apply them promptly once available.
Implement strict concurrency controls and synchronization mechanisms within the application layer to prevent race conditions during cart operations.
Conduct thorough code reviews and testing focused on multi-threaded transaction processing to identify and remediate similar race conditions.
Enable detailed logging and real-time monitoring of cart and checkout transactions to detect anomalies indicative of exploitation attempts.
Employ rate limiting and anomaly detection on cart modification APIs to reduce the risk of automated exploitation.
Isolate critical e-commerce transaction components to minimize the blast radius of potential attacks.
Educate development and operations teams on race condition risks and secure coding practices for multi-threaded environments.
Consider temporary compensating controls such as manual verification of high-value transactions until patches are applied.

Description

CVE-2026-23684 is a race condition vulnerability in SAP Commerce Cloud affecting versions HY_COM 2205, COM_CLOUD 2211, and 2211-JDK21. The flaw allows an attacker to manipulate product entries in a shopping cart, potentially causing erroneous product values to be checked out. This vulnerability impacts data integrity but does not affect confidentiality or availability. Exploitation requires no privileges or user interaction but has a high attack complexity. No known exploits are currently in the wild. The CVSS score is 5.9, indicating a medium severity. European organizations using SAP Commerce Cloud for e-commerce operations could face financial discrepancies and transactional errors if exploited. Mitigation involves applying vendor patches once available, implementing strict concurrency controls, and monitoring transaction logs for anomalies. Countries with significant SAP Commerce Cloud deployments and strong e-commerce sectors, such as Germany, the UK, France, and the Netherlands, are most likely to be affected.

Impact

For European organizations, exploitation of this vulnerability could lead to significant data integrity issues in e-commerce transactions, such as incorrect pricing, product substitutions, or unauthorized discounts being applied during checkout. This can result in financial losses, customer trust erosion, and potential regulatory scrutiny, especially under GDPR mandates related to data accuracy and transaction integrity. While confidentiality and availability remain unaffected, the integrity compromise can disrupt business operations and accounting processes. Organizations operating large-scale online retail platforms using SAP Commerce Cloud are particularly at risk. The impact extends to supply chain partners and customers if erroneous orders propagate downstream. Given the medium severity and lack of required privileges or user interaction, attackers could remotely exploit this vulnerability, increasing the risk profile for exposed systems.

Summary

CVE-2026-23684 is a race condition vulnerability classified under CWE-366 that affects SAP Commerce Cloud products, specifically versions HY_COM 2205, COM_CLOUD 2211, and 2211-JDK21. The vulnerability arises from improper synchronization within a threaded process when adding products to a shopping cart. An attacker can exploit this race condition to cause the system to create cart entries with incorrect product values, which may then be processed during checkout. This flaw compromises data integrity by allowing unauthorized manipulation of transactional data, potentially leading to financial inconsistencies or fraudulent transactions. The vulnerability does not impact data confidentiality or system availability, as it does not expose sensitive information nor cause denial of service. The CVSS 3.1 base score of 5.9 reflects a medium severity, with an attack vector of network, high attack complexity, no privileges required, no user interaction, and unchanged scope. No public exploits have been reported yet, but the vulnerability's nature suggests that attackers could leverage timing attacks or concurrency manipulation to trigger the race condition. The absence of patches at the time of disclosure necessitates proactive mitigation strategies. SAP Commerce Cloud is widely used in enterprise e-commerce environments, making this vulnerability relevant for organizations relying on this platform for online sales and order processing.

CWE-366Race Condition within a Thread (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
Architecture and Design
Use locking functionality. This is the recommended solution. Implement some form of locking mechanism around code which alters or reads persistent data in a multithreaded environment.
Architecture and Design
Create resource-locking validation checks. If no inherent locking mechanisms exist, use flags and signals to enforce your own blocking scheme when resources are being used by other threads of execution.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V1.11.2 (opens in a new tab)
Attack patterns
Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions (opens in a new tab)
Leveraging Race Conditions (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 17 Feb 2026, 09:36 UTC

WeaknessesCWE-366

Technical details

References

Community reviews

Related threats