What you seek is called a commutative cipher. This is not the same thing as "a cipher that is commutative" (the terminology is confusing). A cipher that is commutative is easily achieved with, e.g., the large class of stream ciphers that generate a key-dependent pseudorandom stream and encrypt data by XORing that stream with the data to encrypt. Since XOR is commutative, two instances of such encryption can be applied successively then removed in any order. However, observing the encrypted versions yields too much information to eavesdropper -- this encryption is not as encrypted as you believe it to be.
Generally speaking, a commutative cipher is an encryption method that is commutative and yet is secure enough when used in Shamir's three-pass protocol. In a broad sense, such a commutative cipher cannot be "as secure" as a normal symmetric cipher (see this), but it can still be "secure enough" for the three-pass protocol. Known algorithms that appear to be commutative cipher in that sense (Pohlig-Hellman and SRA) rely on the same kind of mathematical tool as asymmetric encryption and key exchange algorithms like RSA or Diffie-Hellman; correspondingly, they don't offer any actual performance advantage over this more widely used types of algorithms.