CRITICALCVSS v3.1 10.0Actively exploited · CISA KEV since 2022-08-18Vulnerability
CVE-2022-22536
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.
Properties
- Vulnerability name
- SAP Multiple Products HTTP Request Smuggling Vulnerability
- Epss score
- 0.97945
- Last seen
- 2026-10-19T12:00:27+00:00
- Due date
- 2022-09-08
- Exploited euvd since
- 2022-08-18T00:00:00+00:00
- Source url
- https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
- Date added
- 2022-08-18
- Score
- 10
- Euvd base score version
- 3.1
- Euvd vendor
- SAP SE
- In Signal since
- initial import (Sep 2026)
- Euvd base score
- 9.8
- Vendor project
- SAP
- Content hash
- c8b45adcbc681d2eb287bb644901217c6f9ae64516514dc5cc9f442b801dd497
- Published at
- 2022-02-09T23:15:18.620
- Euvd updated
- 2025-10-21T23:15:47+00:00
- Last modified
- 2026-06-17T04:28:33.183
- Euvd epss pct
- 97.95
- Epss percentile
- 0.9991
- Licence
- FIRST EPSS: free to use; attribution requested in publications or products (FAQ)
Related Entities (29 · showing 23)
AFFECTS_PRODUCT (26 · showing 20)
DESCRIBES (1)
HAS_WEAKNESS (1)
INVOLVES (1)
Explore deeper with Ninja Signal's threat intelligence graph