Oracle's Comeback Bid Faces a Crowded Risk Register: Security Flaws, Job Cuts, and a Single-Customer Cloud Bet

Citi sees Oracle's slide as technical, lifts estimates; but OpenAI concentration, BBB- rating, and active exploits keep risk high.

There is a moment in every beaten-down stock's narrative when the bulls step forward and declare the selling overdone. For Oracle, that moment arrived this week with Citigroup's Tyler Radke, who described the past several months as "one of the most extreme dislocations and crashes in the company's history" — and then promptly told clients to buy.

The bank initiated a positive 90-day catalyst watch on Wednesday, reaffirmed its buy rating with a $330 price target, and lifted estimates for fiscal 2028 through 2030. Radke's thesis is straightforward: the recent slide was driven by technical factors — credit spreads and equity issuance clogging the market — rather than a deteriorating business. The stock responded with a 3% gain on the news.

That framing matters. If the sell-off was mechanical rather than fundamental, the logic runs, a recovery should follow once supply-side pressure abates. At €130.00, the shares already sit 23% above their level of 30 days ago and nearly 29% off the late-July 52-week low. The relative strength index of 56.1 suggests room to run before the stock becomes overbought.

Yet the rebound looks fragile against the longer tape. Oracle remains down 22% year-to-date and 36% over twelve months, with the shares still 56% below their September peak. Anyone buying Citi's optimism is stepping into a stock that, despite the recent bounce, trades deep underwater — and for reasons that haven't gone away.

The OpenAI Concentration Problem

The most consequential of those reasons is also the most paradoxical: Oracle's growth engine and its biggest liability are the same entity. S&P Global Ratings cut Oracle's credit rating to BBB- in July — one notch above junk — and explicitly flagged OpenAI as a "central credit risk." Roughly half of Oracle's $638 billion in outstanding performance obligations is tied to the AI partner, according to S&P's assessment. That is not a peripheral concern; it is the crux of both the bull and bear cases, with Oracle's trajectory hitched to a single customer that has yet to turn a profit.

The operational picture adds another layer of strain. Reports indicate Oracle is planning another round of job cuts in August, with some teams facing double-digit percentage reductions. The goal is a leaner payroll before the second fiscal quarter begins on September 1, helping to service the billions in debt taken on to fund AI data center construction. Oracle declined to comment on the reports.

Infrastructure delays compound the pressure. The Jupiter pipeline project — a Green Chile pipeline from an Energy Transfer subsidiary meant to power data centers — has slipped from mid-August to early February 2027 after New Mexico's land agency repeatedly rejected the proposed route.

A Fresh Security Front Opens

While investors parse the balance sheet, Oracle's security team is fighting a more immediate battle. The US cybersecurity agency CISA has added vulnerability CVE-2026-21962 — affecting Oracle HTTP Server and Oracle WebLogic Server — to its catalog of actively exploited flaws. Federal agencies have been told to apply patches by August 27, a deadline that lands today, with CISA citing active exploitation by attackers.

The warning follows Oracle's August security update roughly a week ago, which shipped 943 patches across multiple product families. The company is urging customers to deploy the fixes promptly, but the sheer volume of vulnerabilities in widely deployed enterprise software like WebLogic Server is stretching IT departments thin.

A Pentagon Win Offers Counterweight

Against this crowded risk register, Oracle can point to at least one solid win. The Pentagon awarded the company an enterprise software agreement worth nearly $7 billion in late July, with a base value of $3.31 billion over five years and an option for extension. It is a reminder that beyond the AI wager, Oracle retains a dependable public-sector franchise.

Management has also been on the road pressing the growth narrative. At the Deutsche Bank 2026 Technology Conference, Oracle outlined an AI strategy spanning applications, infrastructure, and database services, citing strong demand across all three and multicloud database usage growth of over 400% in the fourth quarter. Infrastructure is now live in 22 active AWS regions. At the Six Five Summit, executives argued that enterprise AI is shifting from pilots to production, driving demand for distributed cloud infrastructure, tighter governance, and lower long-term costs — though no specific financial figures were offered.

The Volatility Trade Remains

The market's verdict, for now, is cautious stabilization. At €127.78, the stock sits just below the prior close and is up roughly 21% over 30 days. But the annualized volatility of 57% over that same window tells the real story: investors are braced for violent swings as security concerns and workforce questions collide with a multibillion-dollar AI bet.

The short-term case for Oracle is a bet on mean reversion — that capitulation has run its course and Citi's technical explanation holds. The longer-term case requires believing that a single, loss-making customer can justify a $638 billion backlog, that a BBB- rating won't slip further, and that infrastructure delays won't become a pattern. That is not a safe harbor; it is a leveraged recovery wager with a complicated risk profile attached.