A race condition in SAP Commerce Cloud allows an attacker to add items to a shopping cart in such a way that the cart entry may contain an incorrect product value. The flaw undermines data integrity, letting users potentially purchase or access an unintended product, but does not expose confidential data or disrupt application availability.

SAP Commerce Cloud version 2205 and 2211 are susceptible. The vulnerability applies to all instances of the listed editions that have not applied the SAP security patch identified in Note 3689543.

The CVSS score is 5.9, indicating a medium severity vulnerability, while the EPSS score is less than 1%, suggesting a low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote: an attacker performs normal cart operations (adding products) via the public-facing application, causing the race condition to trigger. There is no need for local privileges or privileged access, but the attacker must exploit the timing of the cart addition relative to the internal validation logic. If successful, the attacker could commit fraudulent transactions with incorrect product data.