How severe is CVE-2022-22532?

CVE-2022-22532 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2022-22532 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (82nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-22532?

CVE-2022-22532 primarily affects Sap Netweaver Application Server Java. In total, 9 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-22532?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2022-22532 published?

CVE-2022-22532 was published on 2022-02-09 and last updated on 2026-06-17.

CVE-2022-22532

CVE-2022-22532 is a critical-severity vulnerability in Sap Netweaver Application Server Java with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-444.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 2% (82nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-444
Affected product: Sap Netweaver Application Server Java
Published: 2022-02-09
Last modified: 2026-06-17

Description

In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthenticated attacker could submit a crafted HTTP server request which triggers improper shared memory buffer handling. This could allow the malicious payload to be executed and hence execute functions that could be impersonating the victim or even steal the victim's logon session.

Frequently asked questions

What is CVE-2022-22532?: In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthenticated attacker could submit a crafted HTTP server request which triggers improper shared memory buffer handling. This could allow the malicious payload to be executed and hence execute functions that could be impersonating the victim or even steal the victim's logon session.
How severe is CVE-2022-22532?: CVE-2022-22532 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2022-22532 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (82nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-22532?: CVE-2022-22532 primarily affects Sap Netweaver Application Server Java. In total, 9 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-22532?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2022-22532 published?: CVE-2022-22532 was published on 2022-02-09 and last updated on 2026-06-17.

References

Affected products (9)

cpe:2.3:a:sap:netweaver_application_server_java:7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_java:7.49:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_java:7.53:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_java:krnl64nuc_7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_java:krnl64nuc_7.22ext:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_java:krnl64nuc_7.49:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_java:krnl64uc_7.22:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_java:krnl64uc_7.22ext:*:*:*:*:*:*:*
cpe:2.3:a:sap:netweaver_application_server_java:krnl64uc_7.49:*:*:*:*:*:*:*

More vulnerabilities in Sap Netweaver Application Server Java

CVE-2020-26829 — Critical (CVSS 10.0): SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary…
CVE-2020-6287 — Critical (CVSS 10.0): SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication…
CVE-2010-5326 — Critical (CVSS 10.0): The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require…
CVE-2023-40309 — Critical (CVSS 9.8): SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong…
CVE-2021-37535 — Critical (CVSS 9.8): SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not…
CVE-2020-6263 — Critical (CVSS 9.8): Standalone clients connecting to SAP NetWeaver AS Java via P4 Protocol, versions (SAP-JEECOR 7.00, 7.01; SERVERCOR…

All CVEs affecting Sap Netweaver Application Server Java →

Other CWE-444 (HTTP Request/Response Smuggling) vulnerabilities

CVE-2025-1867 — Critical (CVSS 10.0): Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in ithewei libhv allows…
CVE-2022-22536 — Critical (CVSS 10.0): SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53…
CVE-2018-3907 — Critical (CVSS 10.0): An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub…
CVE-2025-55315 — Critical (CVSS 9.9): Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized…
CVE-2020-15049 — Critical (CVSS 9.9): An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request…
CVE-2026-13763 — Critical (CVSS 9.8): Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote…

Browse all CWE-444 (HTTP Request/Response Smuggling) vulnerabilities →