SAP Keeps Buying Back Its Own Stock as a Maximum-Severity Flaw Lands and AI Doubts Linger

SAP closed 20 vulnerabilities in its September patch cycle, including a CVSS 10.0 flaw, while buybacks continue and the stock sits 15% lower year-to-date.

SAP's September patch cycle delivered 19 new Security Notes plus one additional update, closing 20 vulnerabilities across its product range. The headline item carries the highest severity score the industry uses: a CVSS rating of 10.0 in Extended Passport Processing, tracked as CVE-2026-44756. Critical flaws in NetWeaver and CAP components rounded out the batch, and security reports also flagged a maximum-severity kernel bug that could have opened the door to command execution with SAP administrator privileges.

That the hole is now sealed matters most to operators running SAP landscapes in critical infrastructure. For investors, the rhythm is familiar rather than alarming — SAP's software sits at the center of enterprise operations, so every patch Tuesday draws close scrutiny from the security community.

Buyback Keeps Rolling Through the Noise

Capital returns have not slowed. Between August 31 and September 4, SAP repurchased 576,917 of its own shares for roughly EUR 107.9 million, bringing the running program's total to 6.43 million shares. The pace signals that management is sticking with its return-of-capital playbook even while the share price struggles — a move meant to underscore the company's fundamental worth, though it has yet to absorb the downward pressure in the market.

Cloud momentum offers a counterweight. Lockheed Martin has adopted SAP SuccessFactors for its workforce transformation. Germany's HARTING is pushing its cloud migration forward with RISE with SAP, and NTT DATA is deploying SuccessFactors alongside the Joule AI assistant for a global HR overhaul. Tirlán, the Irish dairy group, built an independent SAP landscape in nine months after splitting from former partner Glanbia — with no interruption to operations or production, according to SAP. Such references serve as proof that complex migrations can land on schedule, a point of interest for large customers weighing similar restructurings.

AI Ambitions Meet a Skeptical Market

At the Goldman Sachs Communacopia + Technology Conference, SAP said it would launch 400 new agents in September, with another wave to follow in the autumn. The message reinforces the AI agenda as the central growth driver — a theme the company had already stressed around its September call.

Investors, however, remain focused on execution. Analyst commentary points to unfinished work integrating AI assistants into the product lineup, and media reports suggest doubts about the pace of progress on those assistants are weighing on sentiment even as the cloud business performs solidly. On Thursday the stock came under notable pressure, closing at EUR 176.70, a drop of 2.0%.

The picture has since brightened slightly. At a current price of EUR 177.98, the shares sit 0.7% above the previous close of EUR 176.70. Over the past seven trading sessions, though, SAP has shed 3.8%, a reminder that the rebound is still fragile. Year-to-date the stock is down 15%, evidence that the combination of security headlines and AI expectations has not sustainably supported the valuation. The gap to the 200-day moving average of EUR 168.08 stands at 5.9% to the upside, hinting at mild medium-term stabilization.

UBS left SAP at "Neutral" on the prior trading day with a price target of EUR 201, signaling no fundamental reassessment despite the recent news flow.

What Comes Next

Third-quarter 2026 results are scheduled for October 21. Until then, the market is likely to keep weighing solid cloud metrics against the unresolved question of how quickly SAP converts its AI strategy into convincing product outcomes. The ongoing buyback remains a stabilizing factor that investors must balance against near-term price weakness.