CVE-2022-22536 is a HTTP request smuggling vulnerability in SAP Multiple Products. CISA added it to the Known Exploited Vulnerabilities catalogue on 18 August 2022, which means attackers have used it in real attacks. SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling.
How HTTP request smuggling works in SAP products
http request smuggling happens when front-end and back-end components disagree about where one request ends and the next begins. In SAP application paths, that parsing mismatch can let an attacker desynchronise traffic, disguise malicious input, or route data to a different backend transaction than defenders expect.
This class of flaw is dangerous because it targets the trust boundary inside the request pipeline rather than a single page or parameter. When a gateway, dispatcher, or application server interprets request boundaries differently, the attacker may be able to bypass security controls, interfere with routing, or chain the issue into broader access and session abuse.
Why CVE-2022-22536 matters
CVE-2022-22536 affects SAP Multiple Products and was added by CISA to the KEV catalogue on 18 August 2022, which confirms real-world exploitation. For background on the vulnerability identifier itself, the official CVE Program and the NIST National Vulnerability Database are the authoritative places to verify the record and track supporting metadata.
The practical significance is not just that the issue exists, but that it was weaponised against SAP software used in enterprise environments. The affected stack includes SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher, so the blast radius can extend across application, content, and traffic-handling layers.
Exposure, remediation, and compensating controls
Organisations should first confirm whether any SAP products in their estate sit on internet-facing paths or handle externally reachable traffic, because request smuggling is most dangerous where untrusted clients can influence HTTP parsing. Asset inventory, service ownership, and vendor advisories are the fastest way to determine whether the vulnerable SAP components are present and exposed.
If patching cannot happen immediately, reduce exposure by tightening access to the affected endpoints, limiting who can reach the dispatcher or application tier, and reviewing any reverse proxy or gateway configuration that could amplify parsing ambiguity. Where applicable, align remediation with the broader advice in the Web Application Attacks Guide, which covers request smuggling among related web-layer attack patterns.
For SAP-specific operational context, the strongest adjacent control concern is making sure the vulnerable products are not left in a state where external traffic can be desynchronised into backend requests. That often means verifying the full request chain, not just the origin server, because the weakness is created by disagreement between layers rather than by a single misconfigured host.
Detection and compromise review after patching
Detection for request smuggling is usually indirect. Security teams should look for anomalous request sequencing, inconsistent logs between proxy and application layers, unexplained 400-series errors, session confusion, or backend activity that does not match the front-end request trail.
After remediation, review logs and downstream application behaviour for signs that an attacker used the flaw before the patch was applied. If the issue was exploited, validate whether sessions, authenticated workflows, or any sensitive transactions were manipulated, and treat the review as a compromise assessment rather than a normal vulnerability closure exercise.
When you need a broader vulnerability-management context for prioritisation and verification, the Vulnerability Management Guide is useful for asset scoping, KEV prioritisation, remediation tracking, and post-fix verification.
Risk and Threat Considerations
Request smuggling is dangerous because it can let an attacker hide malicious traffic inside requests that defenders think are already parsed and understood. In SAP environments, that can create exposure at the gateway, dispatcher, or application server boundary and may let the attacker influence request routing, bypass controls, or interfere with authenticated sessions.
Failure mechanism: A front-end component and a back-end component interpret HTTP boundaries differently, so the attacker’s data is split, queued, or forwarded in a way the security stack does not expect.
Impact: The result can include request confusion, security-control bypass, session interference, and a path to deeper application abuse if the smuggled traffic reaches privileged backend functionality.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | CVE-2022-22536 requires timely remediation of an actively exploited software flaw. |
| SC-7 — Boundary Protection | Request smuggling abuses parsing boundaries between front-end and back-end systems. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Post-patch review depends on logs and anomaly analysis across request-handling layers. | |
| Recommendation — Prioritise patching and verification for exposed SAP components affected by the flaw. Harden and validate traffic paths at proxy and application boundaries. Correlate proxy and application logs to detect smuggling and review pre-patch abuse. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | The term is an actively exploited CVE requiring inventory, prioritisation, and remediation. |
| Recommendation — Track affected SAP assets, prioritise the KEV-listed flaw, and confirm remediation. | ||
| OWASP ASVS | V4 — API and Web Service | HTTP request smuggling is a web/service-layer parsing and routing weakness. |
| Recommendation — Test web and service layers for parsing inconsistencies and request desynchronisation. | ||
Practitioner Guidance
Why practitioners should care: This is a vulnerability class where exposure depends on the whole HTTP chain, not just the SAP host itself. Teams responsible for SAP operations, edge security, and application delivery should coordinate ownership because the fix often spans multiple layers of the request path.
What to watch for: Pay special attention to internet-facing SAP services, reverse proxies, and any configuration change that alters header handling or request normalisation. If a vendor advisory or KEV listing confirms active exploitation, treat the issue as high priority and verify the environment for any signs of pre-patch abuse before declaring the incident closed.