About and disclaimer

What this is

SecondTuesday is an independent, neutral index of SAP Security Patch Day. SAP publishes its security notes on the second Tuesday of every month. This site tracks every Patch Day since January 2023 and lets you sort, filter and compare them.

Where the data comes from

Only public metadata from SAP’s Security Patch Day pages on support.sap.com: note number, title, CVE IDs, CVSS score and vector, priority, affected product and versions, and whether a note is new or updated. We never copy content from login-protected SAP notes. Links to SAP for Me require your own SAP account.

Known exploitation comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. A note is marked “Known exploited” only if one of its CVE IDs exactly matches a KEV entry.

Titles, products and CVE IDs are shown exactly as SAP publishes them, in English, on both language versions. They are not machine-translated.

How to read it

“What to patch first” is a generic ordering: known-exploited first, then SAP priority, then CVSS. Your own exposure, compensating controls and system landscape matter more. Always read the SAP note itself before you patch.

Privacy

No accounts, no analytics, no tracking cookies. The newsletter has not launched: the signup form checks the address and stores nothing. When it launches, it will store only your email address, confirm it by double opt-in, and every email will carry an unsubscribe link that deletes the address.

Disclaimer

SecondTuesday is not affiliated with, endorsed by, or sponsored by SAP SE or CISA. SAP, SAP NetWeaver, SAP S/4HANA and other SAP products mentioned are trademarks or registered trademarks of SAP SE in Germany and other countries. The information is provided “as is” and may contain errors. Always confirm against SAP’s official notes.