Live › vulnerability › CVE-2022-22536
Go to dashboardSAP NetWeaver, ABAP Platform, SAP Content Server and SAP Web Dispatcher can be tricked into HTTP request smuggling. An unauthenticated attacker can prepend arbitrary data to a victim's request, executing functions as the victim or poisoning intermediary web caches.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| SAP Multiple Products | vendor | – | – |
| sap content server | vendor | = 7.53 | – |
| sap netweaver application server abap | vendor | = 7.22 | – |
| sap netweaver application server abap | vendor | = 7.49 | – |
| sap netweaver application server abap | vendor | = 7.53 | – |
| sap netweaver application server abap | vendor | = 7.77 | – |
| sap netweaver application server abap | vendor | = 7.81 | – |
| sap netweaver application server abap | vendor | = 7.85 | – |
| sap netweaver application server abap | vendor | = 7.86 | – |
| sap netweaver application server abap | vendor | = 7.87 | – |
| sap netweaver application server abap | vendor | = 8.04 | – |
| sap netweaver application server abap | vendor | = krnl64nuc_7.22 | – |
| sap netweaver application server abap | vendor | = krnl64nuc_7.22ext | – |
| sap netweaver application server abap | vendor | = krnl64nuc_7.49 | – |
| sap netweaver application server abap | vendor | = krnl64uc_7.22 | – |
| sap netweaver application server abap | vendor | = krnl64uc_7.22ext | – |
| sap netweaver application server abap | vendor | = krnl64uc_7.49 | – |
| sap netweaver application server abap | vendor | = krnl64uc_7.53 | – |
| sap netweaver application server abap | vendor | = krnl64uc_8.04 | – |
| sap web dispatcher | vendor | = 7.22ext | – |
| sap web dispatcher | vendor | = 7.49 | – |
| sap web dispatcher | vendor | = 7.53 | – |
| sap web dispatcher | vendor | = 7.77 | – |
| sap web dispatcher | vendor | = 7.81 | – |
| sap web dispatcher | vendor | = 7.85 | – |
| sap web dispatcher | vendor | = 7.86 | – |
| sap web dispatcher | vendor | = 7.87 | – |
Unknown from the sources.
Apply the SAP security note and update per vendor instructions; the specific note number and patched versions are not in the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.
This page as .md · .json · in your agent: get_signal("CVE-2022-22536")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.