CVE-2022-22534: SAP NetWeaver

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

Due to insufficient encoding of user input, SAP NetWeaver allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password. These endpoints are normally exposed over the network and successful exploitation can partially impact confidentiality of the application.

Affected products

• SAP NetWeaver: version 700 only; version 701 only; version 702 only; version 731 only; version 740 only; version 750 only; …

Published 2022-02-09. Last modified 2026-06-17.