Is CVE-2022-22536 actively exploited?

Yes. CVE-2022-22536 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2022-22536 be exploited remotely?

The attack vector of CVE-2022-22536 has not been classified yet.

What is the CVSS score of CVE-2022-22536?

CVE-2022-22536 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2022-22536

HIGHCISA KEVIN THE WILD

CVE-2022-22536

Published: August 18, 2022

EPSS:93.83%probability of exploitation in 30 daysPercentile:99.9th

Official Description

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.

NVD Source

CISA KEV Advisory

SAP Multiple Products HTTP Request Smuggling Vulnerability

Added to KEV: 2022-08-18Federal patch deadline: 2022-09-08

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

This HTTP request smuggling vulnerability affects various SAP NetWeaver components, allowing an unauthenticated attacker to manipulate a victim's request, potentially leading to impersonation or cache poisoning. The high EPSS score of 0.93833 signifies a high likelihood of exploitation, and its presence in the KEV catalog confirms active exploitation, requiring immediate mitigation.

This vulnerability is actively being exploited in the wild. An unauthenticated attacker can exploit this remotely to prepend arbitrary data to a victim's request.

Recommended Action

Organizations should apply all available security patches and updates for affected SAP NetWeaver components, SAP Content Server, and SAP Web Dispatcher. Implement robust web application firewall (WAF) rules to detect and prevent HTTP request smuggling attacks.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2022-22536 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2022-22536 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.