CVE-2026-23684: Race condition vulnerability in SAP Commerce Cloud
A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being created with erroneous product value which could be checked out. This leads to high impact on data integrity, with no impact on data confidentiality or availability of the application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23684?
CVE-2026-23684 is classified as a high severity vulnerability due to the potential for erroneous product values in cart entries that can lead to significant financial impact.
How do I fix CVE-2026-23684?
To fix CVE-2026-23684, it is recommended to apply the latest security patches provided by SAP for the Commerce Cloud platform.
What are the potential impacts of CVE-2026-23684?
The potential impacts of CVE-2026-23684 include the creation of invalid cart entries that could lead to incorrect product checkouts and financial loss.
Which versions of SAP Commerce Cloud are affected by CVE-2026-23684?
CVE-2026-23684 affects certain versions of SAP Commerce Cloud; users should consult SAP's security advisories for specific version details.
Can an attacker exploit CVE-2026-23684 remotely?
Yes, an attacker can exploit CVE-2026-23684 remotely by manipulating the process of adding products to the cart.