Cyber Resilience

CVE-2022-22536

Sap Netweaver Application Server Abap 7.22 … krnl64uc_8.04

CISA KEVActive ExploitationEUVD Exploited
Published
09 February 2022
Modified
25 February 2026
KEV Added
18 August 2022
Patch / advisory
View advisory
CVSS Score v3.1 10.0
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.98 99.9th percentile
Risk Priority 100 floored blend · peak EPSS

Summary

CVE-2022-22536 is a critical-severity HTTP Request/Response Smuggling (CWE-444) vulnerability in Sap Netweaver Application Server Abap. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53, and SAP Web Dispatcher are affected by a request smuggling and request concatenation vulnerability tracked as CVE-2022-22536. The flaw, assigned CWE-444, permits an unauthenticated remote attacker to prepend arbitrary data to a victim's HTTP request, which can be used to manipulate how the server processes subsequent requests.

An attacker can exploit the issue over the network without authentication or user interaction to impersonate the victim and invoke functions on their behalf or to poison intermediary web caches. Successful exploitation yields complete loss of confidentiality, integrity, and availability, reflected in the CVSS 3.1 base score of 10.0.

SAP has published remediation details in security note 3123396 and the associated February 2022 security patch release, while CISA lists the CVE in its Known Exploited Vulnerabilities catalog, confirming observed in-the-wild activity. The associated EPSS score has remained at a persistently high level, with a current value of 0.9383 and a recorded peak of 0.9683.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This…

more

way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

CWE(s)
CWE-444
KEV Date Added
18 August 2022

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-33987Same product: Sap Web Dispatcher
CVE-2016-2386Same vendor: Sapboth on KEV
CVE-2021-38163Same vendor: Sapboth on KEV
CVE-2017-12637Same vendor: Sapboth on KEV
CVE-2016-3976Same vendor: Sapboth on KEV
CVE-2018-2380Same vendor: Sapboth on KEV
CVE-2023-49584Same vendor: Sap
CVE-2023-27501Same product: Sap Netweaver Application Server Abap
CVE-2023-49581Same product: Sap Netweaver Application Server Abap
CVE-2023-27269Same product: Sap Netweaver Application Server Abap

Affected Assets

sap
content server
7.53
sap
netweaver application server abap
7.22, 7.49, 7.53, 7.77, 7.81
sap
web dispatcher
7.22ext, 7.49, 7.53, 7.77, 7.81

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V4.1.3
  • V4.2.4
  • V1.5.3
  • V4.1.1

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-01 mostly match
prevents

Configuration management can enforce uniform HTTP parsing rules across intermediaries, directly mitigating inconsistent interpretation.

DE.CM-01 partial match
prevents

Network monitoring can detect smuggling attempts via anomalous HTTP traffic or logs, while eliminating the inconsistency directly aids detection of such events.

PR.IR-01 partial match
prevents

Network protections can enforce consistent HTTP proxy/firewall behavior to block smuggling, and removing the weakness helps prevent unauthorized access via request smuggling.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect HTTP request smuggling vulnerabilities in intermediary components.

A.8.20 Networks security partial match
degrades

Network security controls can enforce consistent HTTP parsing and proxy behavior that mitigates request smuggling.

A.8.21 Security of network services partial match
degrades

Secure network services include hardening proxies and gateways against inconsistent HTTP interpretation.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC practices require threat modeling and testing for HTTP parsing inconsistencies in intermediaries.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate strict HTTP message validation and canonicalization.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles include consistent protocol handling and defense-in-depth for proxies.

References