SAP Security Patch Day is a monthly release of SAP Security Notes on the second Tuesday of the month, a date SAP says is synchronized with the patch days of other major software vendors. Teams running SAP landscapes read the notes, select the ones that apply, test them and schedule the corrections.
What gets published
SAP publishes its corrections as SAP Security Notes, focused solely on security. It sorts them into two groups:
- Patch Day Security Notes, which SAP wants you to look at on patch day.
- Support Package Security Notes, which are meant to arrive automatically when you upgrade support packages.
The split exists so teams focus on important fixes on patch day and treat the rest as part of normal upgrades. SAP's page says its Security Notes are accessed in SAP for Me, under All Security Notes, and that it recommends implementing the corrections at a priority.
2026 dates
SAP lists these Patch Day dates for 2026:
| Month | Date |
|---|---|
| January | 13 |
| February | 10 |
| March | 10 |
| April | 14 |
| May | 12 |
| June | 9 |
| July | 14 |
| August | 11 |
| September | 8 |
| October | 13 |
| November | 10 |
| December | 8 |
These match the second Tuesday of each month, which is also when Microsoft ships its monthly update. If you run Windows servers under SAP, expect two sets of changes to review the same day. Plan separate owners or you will do both poorly.
The support package rule
SAP's page describes a rule in place since 11 June 2019. For new Security Notes with high or very high severity, SAP delivers fixes for SAP NetWeaver based products only for support packages shipped within the last 24 months, provided the product version is still in mainstream or extended maintenance. There are exceptions listed in the Security Notes FAQ, and notes with low or medium priority are corrected in at least the newest support package of mainstream and extended maintenance releases.
The practical meaning is simple. If your support package is older than the window, a high severity note may have no correction for you. Your fix is to move to a newer support package, so track how old yours is.
A monthly routine
- Patch Day morning: pull the new notes and filter to the components in your environment.
- Rate each note against exposure. An internet-facing portal outranks a back-office module.
- Send a short summary to owners with a decision needed by date.
- Apply to sandbox and quality systems first, with the regression tests your business users trust.
- Schedule production changes through your normal change process.
- Record the notes applied, the notes deferred and the reason.
Keep the list of SAP components and their support package dates current. It is the input that turns step 1 from hours into minutes.
Try it yourself
Click through it at your own pace, or open it full screen.
Notice how findings carry owners and fix status. That is the shape your Patch Day summary should take as well.
Safeguard covers SBOM and dependency scanning for code you build and integrate around such systems, and a free scan is a quick way to see that picture.
Quick check
Is SAP Patch Day the same day as Microsoft Patch Tuesday?
SAP schedules it on the second Tuesday of every month and says this is synchronized with other major vendors. Microsoft's monthly update is also on the second Tuesday.
What if my support package is old?
SAP says high and very high severity fixes for NetWeaver based products are delivered only for support packages shipped within the last 24 months, with listed exceptions. Plan an upgrade.
Sources
- SAP, SAP Security Notes and News
- Microsoft Learn, Update release cycle for Windows clients
Last reviewed: 19 October 2026.
