Critical 9.8Known exploited (CISA KEV)Published Feb 9, 2022

CVE-2022-22536SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenat…

Updated under an hour ago (2026-10-19 07:10 UTC)

Does this affect you?

It affects SAP SE SAP NetWeaver and ABAP Platform and 5 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Aug 18, 2022; federal agencies had to remediate by Sep 8, 2022. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for SAP SE SAP NetWeaver and ABAP Platform

Exploited in the last 30 days

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.

CVSS: 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-444
Known exploited: Added to CISA KEV Aug 18, 2022; federal remediation due Sep 8, 2022Apply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 97.95% (percentile 100)
Assigned by: sap
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

SAP SE SAP NetWeaver and ABAP Platform sap_se:sap_netweaver_and_abap_platform (from the name)	KERNEL 7.22; 8.04; 7.49; 7.53; 7.77; 7.81; 7.85; 7.86; and 5 more ranges	CNA record
SAP SE SAP Web Dispatcher sap_se:sap_web_dispatcher (from the name)	7.49; 7.53; 7.77; 7.81; 7.85; 7.22EXT; 7.86; 7.87	CNA record
SAP SE SAP Content Server sap_se:sap_content_server (from the name)	7.53	CNA record
sap content_server sap:content_server	7.53	NVD
sap netweaver_application_server_abap sap:netweaver_application_server_abap	7.22; 7.49; 7.53; 7.77; 7.81; 7.85; 7.86; 7.87; and 9 more ranges	NVD
sap web_dispatcher sap:web_dispatcher	7.22ext; 7.49; 7.53; 7.77; 7.81; 7.85; 7.86; 7.87	NVD

References

https://launchpad.support.sap.com/#/notes/3123396x-refsource-misc, permissions-required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlx-refsource-misc, broken-link, not-applicable, vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22536us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.