Nine Critical Flaws, a Doubled Price Target and AstraZeneca's Cloud Bet: SAP's Eventful Week

SAP pushed out 35 new security notes for its November Patch Day, nine of them rated critical, as media reports on Thursday indicated the most serious vulnerabilities touch multiple SAP products. Four of the disclosed flaws carry the maximum CVSS score of 10.0, affecting NetWeaver, Web Dispatcher and Gateway, according to reports drawn from the security advisories. No evidence of active exploitation had surfaced as of the reporting.

The patch release landed in a week otherwise dominated by bullish news on the cloud and AI front. On Monday, JPMorgan lifted its rating on SAP from "Neutral" to "Overweight" and raised its price target to 275 euros from 175. Analyst Toby Ogg tied the upgrade to artificial intelligence shifting inside enterprises from pilot projects into productive use, while also pointing to progress on SAP's own AI offerings.

AstraZeneca Signs On

The following day brought a significant customer win. AstraZeneca confirmed it will move to SAP Cloud ERP Private through RISE with SAP and is evaluating the use of SAP Business AI. By SAP's account, the planned migration covers one of the largest SAP system landscapes in the life sciences sector and extends a partnership that has run for 20 years. The announcement covers the intended shift to the cloud solution; it was not reported as a completed transition.

SAP's cloud ERP portfolio also drew external recognition during the week. A Monday release said the company was named a "Leader" in the 2026 Gartner Magic Quadrant for product-centric enterprises for the fifth consecutive time. SAP said it received the same designation in the Gartner Magic Quadrant for cloud ERP for service-centric enterprises, likewise for the fifth year running. The two assessments cover distinct user groups of the cloud ERP offering.

Buyback Progress

Shareholder returns advanced as well. SAP reported on Tuesday that it repurchased roughly 465,000 of its own shares via XETRA between November 2 and November 6 inclusive. The cumulative total under the current program reached about 9.6 million shares through November 6, meaning the disclosed purchases cover a period already closed.

On the product security side, SAP paired the 35 security notes with four GitHub Security Advisories, rounding out the week's corporate announcements with security information for users of its products.

CFO Takes the Road

Investor engagement is next on the calendar. SAP announced Thursday that CFO Dominik Asam will appear at two conferences: the Morgan Stanley TMT Conference on November 19 and the UBS Global Technology Conference on December 1. Both appearances are set to be webcast.