CVE-2022-22536: SAP NetWeaver and Web Dispatcher HTTP request smuggling

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 10.0, unauthenticated network exploitation, KEV listing and very high EPSS probability make this a top remediation priority.

What it is

SAP NetWeaver Application Server ABAP, NetWeaver Application Server Java, ABAP Platform, Content Server 7.53 and Web Dispatcher mishandle HTTP requests, allowing request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data, which can lead to impersonation of the victim or poisoning of intermediary web caches. The flaw affects confidentiality, integrity and availability of the whole system.

Impact

An attacker can execute functions while impersonating another user and poison intermediary caches, potentially leading to complete compromise of confidentiality, integrity and availability.

Attack surface

Reachable over the network via HTTP requests to the affected SAP components; the CVSS vector shows no privileges or user interaction required. No specific endpoint or version detail is given in the record.

Exploitation

Listed in CISA KEV since 2022-08-18 with a required action to apply vendor updates, and EPSS probability is 0.97945 (percentile 0.99906), indicating active exploitation is expected. No ransomware campaign use is documented.

What to do

• Apply the SAP security note 3123396 updates for NetWeaver AS ABAP, NetWeaver AS Java, ABAP Platform, Content Server 7.53 and Web Dispatcher.
• If patching cannot be done immediately, restrict or monitor direct HTTP access to affected SAP components and web dispatchers.
• Review and harden intermediary cache and proxy configurations to reduce request smuggling and cache poisoning exposure.
• Verify that all affected SAP instances and dispatchers are inventoried so none are missed during remediation.

Detection

• Inspect HTTP traffic for malformed or concatenated requests, duplicate Content-Length or Transfer-Encoding headers, and smuggling patterns.
• Monitor web server and dispatcher logs for anomalous request sequences or unexpected cache behavior.
• Correlate authentication and application logs for actions performed by users who did not initiate them, indicating impersonation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.