SAP Note 3832186: what happens to ECC on Oracle, DB2 or SQL Server from 2031

SAP released a Hot News note, backed by a message from its CTO, Philipp Herzig, that puts a date on the practical end of SAP systems running on third-party databases. Oracle, DB2 and SQL Server will keep running after 2030, but from January 1, 2031 SAP stops providing almost everything needed to run them safely: kernel, security patches, tooling and migration paths.

The essentials

Note 3832186, version 4, October 7, 2026
Who is affected
SAP ERP 6.0 (ECC), CRM 7.0, SCM 7.0, SRM 7.0 and any NetWeaver ABAP or Java system running on Oracle, Microsoft SQL Server or IBM Db2 (Linux, UNIX and Windows, IBM i or z/OS).
Key date
January 1, 2031, when these products move into Customer Specific Maintenance (CSM) with heavily reduced support for third-party databases.
The worst part
There will be no kernel or security patches, and no supported migration path out of that database.

The full timeline

  1. Until 2027

    Mainstream maintenance

    Full SAP support, including on Oracle, DB2 and SQL Server.

  2. 2028 to 2030

    Extended maintenance

    Optional and paid. The last window to migrate with supported tooling.

  3. From 2031

    Customer Specific Maintenance

    No kernel or security patches, no SUM, SWPM or R3load and no supported migration path.

Source: SAP Note 3832186 and related notes 2881788 and 1648480.

What SAP stops providing from 2031

The note details the limitations for any Business Suite 7 or NetWeaver system on a third-party database that enters CSM. In summary:

One point is easy to miss. According to the note, secondary database connections from an SAP ABAP server to a third-party database are no longer supported either, even when the system's primary database is already an SAP database. It is worth checking whether any interface relies on a connection like that.

Why it is a security issue

Without kernel or database patches, a system in this situation has no SAP-supported way to fix new vulnerabilities, and the note makes clear that the exposure falls on the customer. To put it in perspective, think of OVERPASS, the CVSS 10 kernel flaw SAP fixed in September 2026. From 2031, a system on a third-party database would not receive a patch like that.

The options SAP lays out

The note recommends starting to plan immediately, while systems are still under mainstream or extended maintenance, and lays out three paths:

What to do now

Take a full inventory. The review goes beyond ECC, because the note applies to any NetWeaver ABAP or Java system on a third-party database, so it is worth checking BW, PI/PO, Portal, Solution Manager and any other satellite system too.

Check secondary connections. Identify the interfaces that connect from an ABAP system to Oracle, DB2 or SQL Server as a secondary database, even if the main system already runs on HANA.

Do not leave the migration for 2030. The tools that make migration possible, such as SUM, SWPM and R3load, are only supported while the system is under mainstream or extended maintenance. Planning early lets you rehearse the migration several times before cutover, something that is no longer possible if it is left for the end.

If your company already runs S/4HANA on RISE with SAP, your main system runs on HANA and the core of this note does not affect you. Even so, it is worth reviewing secondary connections and any satellite systems that have not moved yet.

Sources

If your company still runs ECC on Oracle, DB2 or SQL Server and you want to review which systems are exposed and how RISE runs after Go-Live, let's talk.

See all blog articles