Description
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's request with arbitrary data. This way, the attacker can execute functions impersonating the victim or poison intermediary Web caches. A successful attack could result in complete compromise of Confidentiality, Integrity and Availability of the system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SAP SE | SAP NetWeaver and ABAP Platform | KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, KRNL64NUC 7.22 | — |
| SAP SE | SAP Web Dispatcher | 7.49, 7.53, 7.77, 7.81, 7.85, 7.22EXT, 7.86, 7.87 | — |
| SAP SE | SAP Content Server | 7.53 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- SAP NetWeaver - 7.53 - HTTP Request Smuggling EDB-52109 · remote · Apr 2, 2025
GitHub 4 repositories
-
ZZ-SOCMAP/CVE-2022-22536 ★ 51 · Feb 15, 2022
SAP memory pipes(MPI) desynchronization vulnerability CVE-2022-22536.
-
tess-ss/SAP-memory-pipes-desynchronization-vulnerability-MPI-CVE-2022-22536 ★ 10 · Apr 2, 2022
-
BecodoExploit-mrCAT/SAPGateBreaker-Exploit ★ 5 · Apr 1, 2025
SAPGateBreaker is a PoC exploit for CVE-2022-22536, a critical HTTP Request Smuggling vulnerability in SAP NetWeaver. It demonstrates how to bypass ACLs by desynchronizing request parsing between ICM…
-
abrewer251/CVE-2022-22536_SAP_Request_Smuggling_Scanner ★ 0 · Oct 31, 2025
Fast, socket-level scanner for detecting CVE-2022-22536 in SAP ICM or Web Dispatcher instances. Performs request smuggling tests with a crafted MPI-desync payload. Supports batch scanning IP:PORT tar…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- SAP Memory Pipes (MPI) Desynchronization http/cves/2022/CVE-2022-22536.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.