dbcve.org
Commerce CloudApplication · Sap

CVE-2026-23684

MEDIUM · 5.9 CVSS v3.1 Published 2026-02-10
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
68/100
Remediation priority · Elevated
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being created with erroneous product value which could be checked out. This leads to high impact on data integrity, with no impact on data confidentiality or availability of the application.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

A race condition vulnerability in SAP Commerce cloud's cart management allows an attacker to manipulate cart entries by rapidly adding products, resulting in cart entries with erroneous product values that can be checked out. The lack of proper synchronization during concurrent cart operations enables the creation of invalid cart data that passes through checkout, impacting data integrity but not confidentiality or availability.

MitigationApply available SAP security patches for SAP Commerce cloud and implement proper transaction locking or atomic operations for cart entry creation to prevent concurrent manipulation.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Commerce CloudApplication
Affected:= 2205= 2211

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify SAP Commerce Cloud installation and version
    Query the system for SAP Commerce Cloud version information - typically found in the installation manifest, version.properties file, or via administration console
    Affected if The installed version matches 2205 or 2211 exactly
  2. Verify cart management module is active
    Confirm the cart management module is enabled and accessible - check storefront or API endpoints related to cart operations (/cart, /cartEntries)
    Affected if Cart functionality is available and accessible to users
  3. Check for concurrent cart operation exposure
    Inspect web application configuration or API security settings to determine if cart operations allow concurrent/rapid requests without rate limiting
    Affected if Cart operations accept multiple concurrent requests without proper synchronization controls
  4. Audit cart entries for data integrity anomalies
    Query the database or cart session data for cart entries where product values appear inconsistent, mismatched, or invalid - look for entries where product ID, quantity, or price do not align with actual product catalog
    Affected if Cart entries exist with erroneous product values that cannot be traced to valid product records or show signs of concurrent manipulation
  5. Review checkout process validation
    Examine checkout flow configuration to determine if cart data is validated before purchase completion - check if invalid cart entries can proceed to order creation
    Affected if The checkout process accepts cart entries without full validation of product data integrity

A user is affected if running SAP Commerce Cloud versions 2205 or 2211 with cart management enabled and the race condition has resulted in invalid cart entries that could proceed to checkout.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply available SAP security patches for SAP Commerce cloud and implement proper transaction locking or atomic operations for cart entry creation to prevent concurrent manipulation.

Recommended fix Moderate confidence

SAP Commerce Cloud 2305 or later (latest stable release recommended)

  1. 1. Identify the current SAP Commerce Cloud version in your environment by checking the version manifest or system information.
  2. 2. Plan an upgrade to a version newer than 2211 (such as 2305 or later) that includes the fix for this race condition vulnerability.
  3. 3. Review SAP Commerce Cloud release notes for version 2305 or later to confirm the vulnerability fix is included.
  4. 4. Perform a thorough test of cart operations (add to cart, modify quantities, checkout) in a non-production environment before upgrading.
  5. 5. Schedule a maintenance window and execute the upgrade following SAP's standard upgrade documentation.
  6. 6. After upgrade, verify cart functionality works correctly and validate that the race condition is no longer present by testing concurrent cart operations.
  7. 7. Monitor logs and transaction data post-upgrade to ensure data integrity in cart entries.
Caveat Review SAP Commerce Cloud release notes for potential breaking changes between 2211 and target version, particularly regarding cart and checkout APIs

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Commerce Cloud Scoped from the published advisory
  • Consultation6.0 h
  • Implementation12.0 h
  • Testing8.0 h
  • Review / QA4.0 h
30.0 hours of engineering $5,280
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $8,448.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-23684 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-23684 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data