Race condition vulnerability in SAP Commerce Cloud (SAP_SE SAP Commerce Cloud)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.19 % · percentile 8 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Analyzed
Description
A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being created with erroneous product value which could be checked out. This leads to high impact on data integrity, with no impact on data confidentiality or availability of the application.
Weaknesses (CWE)
- CWE-366 — Race Condition within a Thread
- CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N | sap |
| CVSS 3.1 | MEDIUM 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N | NVD · cna@sap.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-6459
- GCVE · GCVE-0-2026-23684
CERT-FR advisories
- CERTFR-2026-AVI-0141 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:sap:commerce_cloud:2205:*:*:*:*:*:*:*cpe:2.3:a:sap:commerce_cloud:2211:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP Commerce Cloud | affected HY_COM 2205 ; affected COM_CLOUD 2211 ; affected 2211-JDK21 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |