About and disclaimer

What this is

SecondTuesday is an independent, neutral index of SAP Security Patch Day. SAP publishes its security notes on the second Tuesday of every month. This site tracks every Patch Day since January 2023 and lets you sort, filter and compare them.

Where the data comes from

The CVE records that SAP publishes as a CVE Numbering Authority (CNA), from the CVE List (CVE.org, CVE Services API). Each record gives the CVE ID, the SAP note number (from the record’s reference links), the title (the CNA title), the CVSS score and vector, the affected products and versions, and the publication time. The list of SAP CVEs is cross-checked against the NVD API 2.0 (filtered to SAP’s CNA identifier); NVD data fills in only where a CVE.org record is unavailable. We never fetch, scrape or copy SAP’s own web pages or SAP notes. Links to SAP for Me need your own SAP login.

A CVE belongs to the Patch Day on or before its publication date in UTC (SAP’s records appear around midnight UTC on Patch Day). CVEs published on other days are marked “Published outside Patch Day”. A month without a single SAP CVE is treated as an error, never shown as empty.

Priority is derived from CVSS, not SAP’s priority: 9.0 or higher Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority labels appear only in SAP for Me.

Coverage: notes without a CVE, notes with only third-party CVEs (for example Apache, Spring or OpenSSL CVEs assigned by other CNAs) and updates to earlier notes are not covered, about 7% of new notes. This is not official SAP guidance; check SAP for Me for the complete list.

Known exploitation comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. A note is marked “Known exploited” only if one of its CVE IDs exactly matches a KEV entry.

Titles, products and CVE IDs are shown as the CVE records state them, in English, on every language version. They are not machine-translated.

Licences and attribution

CVE records: Copyright © 1999–2026, The MITRE Corporation. CVE® and the CVE logo are registered trademarks of The MITRE Corporation.

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy. (CVE Terms of Use, https://www.cve.org/Legal/TermsOfUse)

This product uses the NVD API but is not endorsed or certified by the NVD.

Known-exploited status: CISA Known Exploited Vulnerabilities (KEV) catalog (cisa.gov).

How to read it

“What to patch first” is a generic ordering: known-exploited first, then priority (derived from CVSS, not SAP’s priority), then CVSS. Your own exposure, compensating controls and system landscape matter more. Always read the SAP note itself before you patch.

Privacy

No accounts, no analytics, no tracking cookies. The newsletter stores your email address, language and a few timestamps, confirmed by double opt-in; every email has a one-click unsubscribe that deletes the address. Details are on the Privacy page.

Disclaimer

SecondTuesday is not affiliated with, endorsed by, or sponsored by SAP SE or CISA. SAP, SAP NetWeaver, SAP S/4HANA and other SAP products mentioned are trademarks or registered trademarks of SAP SE in Germany and other countries. The information is provided “as is” and may contain errors. It is not official SAP guidance; always confirm against SAP’s official notes in SAP for Me.