Yes. CISA added CVE-2022-22536 to its Known Exploited Vulnerabilities catalogue on 18 August 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling.
What does active exploitation mean for this SAP request smuggling CVE?
Once a vulnerability is in CISA’s KEV catalogue, the practical question is no longer whether it is theoretically dangerous, it is whether exposed systems may already be targetable. For this SAP issue, the right interpretation is that internet-reachable or partner-reachable SAP front ends should be treated as urgent exposure until inventory, patch status, and compensating controls are confirmed.
Request smuggling is especially important because it can undermine the boundary between front-end and back-end components. That makes it relevant to routing, authentication assumptions, cache behaviour, and any control that depends on the proxy seeing the same request as the application does.
Where SAP environments are most likely to be exposed
The primary exposure is not just the named SAP products, but any deployment path that places HTTP traffic through intermediaries that parse or normalise requests differently. That includes reverse proxies, load balancers, web dispatchers, application gateways, and chained middleware where one component accepts a request the next component interprets differently.
In practice, the first check is simple: identify every Internet-facing or externally reachable SAP instance, then map which ones sit behind a proxy or dispatcher and whether that path is used for business-critical sessions, SSO flows, or administrative access. The vulnerability matters most where a crafted request can influence a trusted back-end request without being visible at the edge.
How to respond before and after patching
Use CISA’s KEV entry and the vendor advisory as the authoritative sources for version-specific remediation steps, then treat patching as only one part of the response. CISA Known Exploited Vulnerabilities Catalog should be paired with SAP guidance so you can confirm the right system scope and rollback plan before change windows open.
Where immediate patching is not possible, reduce exposure by constraining access to affected SAP entry points, removing unnecessary external reachability, and tightening intermediary handling rules as far as your architecture allows. For teams wanting a broader triage model, Zero-Day and Exploited Vulnerabilities Guide and Vulnerability Management Guide both support a KEV-first response process with verification, exceptions, and post-fix validation.
After remediation, validate that the vulnerable request path is no longer reachable and that the proxy-to-back-end chain is handling requests consistently. For request-smuggling classes, that verification is as important as the patch itself because a partially mitigated path can remain exploitable if one component still disagrees about request boundaries.
Risk and Threat Considerations
Request smuggling can let an attacker desynchronise front-end and back-end parsing, which creates room for request hijacking, cache poisoning, auth bypass, and secondary exploitation of trusted internal paths. In SAP environments, that is especially concerning because the same edge path may carry authenticated user traffic and administrative functions.
Failure mechanism: The attacker sends carefully shaped HTTP traffic so the intermediary and the application do not agree on where one request ends and the next begins, allowing hidden or replayed data to ride inside a trusted session flow.
Impact: Depending on placement and traffic flow, that can expose user data, alter application behaviour, undermine access controls, or provide a foothold for follow-on compromise of connected SAP services.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation makes rapid vuln triage and remediation central. |
| Recommendation — Prioritise KEV-listed vulnerabilities for immediate remediation and verification. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | The question is about confirming exploitable exposure and remediation urgency. |
| SI-2 — Flaw Remediation | Exploited request-smuggling flaws require prompt correction and post-fix validation. | |
| Recommendation — Track exposed SAP assets and validate remediation status against current vulnerability intelligence. Apply fixes quickly and verify the vulnerable request path is no longer reachable. | ||
| NIST CSF 2.0 | DE.CM-09 — External Service Provider Activities and Risk Monitoring | External-facing SAP services and intermediaries must be monitored for abnormal activity. |
| Recommendation — Monitor externally reachable SAP services for signs of exploitation and anomalous request behaviour. | ||
| OWASP ASVS | V4 — API and Web Service | HTTP request smuggling is a web-service boundary problem affecting request handling. |
| Recommendation — Validate that front-end and back-end services interpret requests consistently across the HTTP chain. | ||
| MITRE ATT&CK | T1190 — Exploit Public-Facing Application | The vulnerability is exploited through externally reachable application interfaces. |
| Recommendation — Hunt for exploitation activity against public-facing SAP application endpoints. | ||
Practitioner Guidance
What to verify: Confirm which SAP systems are in scope, which of them are externally reachable, and whether request-processing intermediaries sit in front of the vulnerable service. If you cannot prove the traffic path, you do not yet know your real exposure.
Decision rule: If the system can receive untrusted HTTP traffic, treat it as urgent until either the fix is applied or the exposure is removed. If the patch must wait, reduce reachable surface first, then monitor for anomalous request patterns and session anomalies on the affected path.
Practitioner takeaway: KEV inclusion is the operational signal to act immediately, but with request smuggling the post-change validation is just as important as the patch, because the security failure often lives in how components interpret the same request differently.
Related resources from NHI Mgmt Group
- CVE-2022-22536 (SAP Multiple Products HTTP Request Smuggling)
- Is CVE-2022-48503 (Apple Multiple Products Unspecified) being exploited in the wild?
- Is CVE-2022-48618 (Apple Multiple Products Memory Corruption) being exploited in the wild?
- Is CVE-2022-47966 (Zoho ManageEngine Multiple Products Remote Code Execution) being exploited in the wild?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org