Oracle Faces Twin Storms: A Record Cloud Quarter and a Zero-Day Breach Drag the Stock Down

Oracle shares fall 14% after cloud revenue miss and critical PeopleSoft zero-day breach affecting 500k students, as firm pivots to capital-intensive AI infrastructure.

Oracle is reeling from a double blow that has left its shares trading at €159.18, down roughly 14% over the past seven sessions. The sell-off started with a seemingly minor miss in cloud revenue that overshadowed otherwise stellar quarterly results — and then a critical zero-day vulnerability in PeopleSoft turned into a full-blown data breach, hitting nearly 500,000 university students.

The immediate trigger for the stock’s slide was Oracle’s fiscal fourth-quarter 2026 report, released last week. Revenue surged 21% year over year to $19.2 billion, with cloud sales jumping 47% to $9.9 billion. Cloud infrastructure alone more than doubled, up 93%. Yet these figures fell a few hundred million dollars short of analyst expectations on the cloud line — a gap that the market punished mercilessly.

Just days later, on June 10, Oracle issued a security advisory for CVE-2026-35273, a PeopleSoft Enterprise PeopleTools vulnerability with a CVSS score of 9.8 — the highest criticality rating. The flaw allows unauthenticated remote code execution, and the hacker group ShinyHunters (tracked as UNC6240 by Mandiant and Google Threat Intelligence) had already been exploiting it since May 27. Oracle’s patch arrived on the same day as the advisory, but the damage was done: personal and academic data belonging to roughly 500,000 students was stolen and released. Universities accounted for 68% of the affected organisations.

The US cybersecurity agency CISA added the flaw to its catalog of known exploited vulnerabilities and gave federal agencies until June 15 to apply the patch. Oracle fixed the issue in PeopleTools versions 8.61 and 8.62; users on older versions must upgrade to a supported release. The attack technique involved a gadget chain that combined the zero-day with previously known vulnerabilities, enabling large-scale unauthorised access to PeopleSoft ERP systems used in HR, payroll, finance and campus management.

The security crisis compounds a deeper financial narrative that has investors in two minds. Oracle posted record operating cash flow of $32 billion for the full fiscal year 2026, up 54%, but free cash flow swung to a negative $23.7 billion. Capital expenditure soared 162% to $55.7 billion as the company transforms from a high-margin software licenser into a capital-intensive cloud infrastructure provider. Gross margins are already under pressure, and management warned that the trend will continue into fiscal 2027 as new data centres come online.

To fund that expansion, Oracle plans to raise roughly $40 billion through debt and equity in the coming year, including a $20 billion stock issuance already announced. Net capital expenditure is expected to reach about $70 billion, according to CFO Hilary Maxson. The long-term bet rests on a jaw-dropping backlog of remaining performance obligations worth $638 billion — up 363% year over year — much of it tied to large AI contracts. Prepaid and customer-supplied GPU commitments alone amount to $75 billion, providing some balance-sheet relief.

Analysts are split on the outlook despite the strong results. Scotiabank cut its price target from $290 to $241 but retained an Outperform rating, praising what it called “rock-solid core business.” RBC Capital kept Sector Perform with a $190 target, while Wedbush trimmed to $240 and BMO actually raised its target to $220. The consensus among 34 analysts is a Buy, with an average price target of €220.45 — roughly 38% above the current level.

Technically, the stock is hovering near its 50-day moving average of €158.89 and sits about 10% below the 200-day average. The relative strength index of 42 (primary) or 42.4 (secondary) indicates neither oversold conditions nor strong recovery momentum. Annualised volatility of nearly 70% reflects a market pricing in both the upside of a $638 billion backlog and the risk that capital intensity will keep margins depressed.

Oracle’s transformation is a bet on the next decade of computing — engineers from Oracle Cloud Infrastructure, Nvidia and Google described the shift toward integrated AI systems at Data Center World 2026 — but the immediate path is fraught. Shares are now 43% below their 52-week high from September 2025. The next earnings report on September 17 will test whether margins are holding up. In the meantime, an ex-dividend date of July 10 offers a small consolation: $0.50 per share. But with a zero-day breach still fresh and a $40 billion capital plan unfolding, investors have little room for complacency.