SAP's AI Shopping Spree Collides With a Maximum-Severity Security Flaw

SAP lowers 2026 profit guidance due to acquisition dilution, while cloud growth remains strong and critical vulnerabilities emerge.

The software giant's transformation story is getting more complicated — and more expensive — by the week. SAP has been on an acquisition tear to bolster its artificial intelligence and data platform ambitions, but the bill for that strategy is now visible in its own profit guidance, just as a fresh batch of critical security vulnerabilities lands on the company's patch table.

The Price of Ambition

SAP's acquisition spree — which includes the mid-July purchase of Prior Labs, the earlier takeover of Dremio, and a strategic investment in workflow automation platform n8n — has a tangible cost. The company trimmed its 2026 non-IFRS operating profit outlook to a range of €11.8 billion to €12.2 billion, down from the previously communicated €11.9 billion to €12.3 billion. Management attributes the adjustment to a dilution effect exceeding €100 million stemming from the deals.

The n8n investment, made in May, carries its own headline number: the platform's valuation doubled to $5.2 billion from $2.5 billion in connection with SAP's participation. Under a multi-year commercial agreement, n8n's technology is slated for native integration into Joule Studio, SAP's AI platform.

Cloud Momentum Provides Cover

The spending spree is underpinned by a cloud business firing on all cylinders. Second-quarter cloud backlog climbed 27% to €22.9 billion, while cloud revenue advanced 24% on a currency-adjusted basis. The cloud ERP suite was the standout performer, growing 27% in constant currency. Total revenue rose 9% as reported, or 11% currency-adjusted.

Despite the lowered profit outlook, SAP reaffirmed its full-year cloud revenue guidance of €25.8 billion to €26.2 billion on a currency-adjusted basis — representing growth of 23% to 25% versus 2025.

Analysts Tap the Brakes

The market's response to the deal-driven guidance cut has been measured. Four major houses — Berenberg, Barclays, Bernstein, and Citi — all reaffirmed buy ratings on Friday while simultaneously trimming their price targets, a classic signal that the recent rally has already priced in much of the good news.

The broader consensus remains firmly constructive. Across 28 analysts, 24 rate the stock a buy, four say hold, and none recommend selling. The average price target stands at €203.22. The stock closed Friday at €179.80, down 0.7% on the day — a modest pause after a powerful recovery. On a 30-day basis, the shares have appreciated roughly 33%, though they remain about 25% below the 52-week high of €242.00 reached in October 2025.

A Maximum-Severity Vulnerability

The security front, meanwhile, delivered its own brand of turbulence. At the August patch day, SAP released 28 new security notes plus a GitHub security advisory, along with two updates to previously published notices. Security firm Onapsis, which tracks the company's disclosures closely, counted 33 new and updated notes when including follow-up releases tied to the original August batch.

Two vulnerabilities stand out for their severity ratings. CVE-2026-58231, affecting the data hub adapter of SAP Commerce Cloud, carries a perfect CVSS score of 10.0. A second flaw, CVE-2026-44772 in SAP Manufacturing Integration and Intelligence, is rated 9.9. SAP NetWeaver and the ABAP Platform are also affected.

The market has largely shrugged — patch-day disclosures are routine for a software company of SAP's scale — but the timing is awkward. The security disclosures arrive roughly three weeks after Reuters reported that SAP had cut its operating profit forecast for the current year due to AI-related data acquisitions, a story that initially rattled investors before being digested.

Regulatory Relief and a Skills Bet

On the regulatory front, the environment has brightened. Germany's Federal Cartel Office closed its proceedings against SAP, and the European Commission wrapped up its review of maintenance and support policies for on-premise solutions. SAP welcomed both outcomes.

The company is also thinking beyond products. Two weeks ago in Singapore, SAP unveiled its "AI-Bilingual Workforce Program," an initiative designed to equip more than 3,000 citizens and permanent residents with enterprise-focused AI skills over the next three years — part of a broader push to embed AI not just in software but in customer workforces.

What to Watch

The next major catalyst arrives on October 21, when SAP reports third-quarter 2026 results. Between now and then, the market will be weighing whether the company can juggle its parallel priorities: closing the gap between its profit guidance and its acquisition appetite, keeping the cloud growth engine humming, and managing a security portfolio that now includes a maximum-severity flaw. The fundamental story around cloud growth and AI-driven acquisitions remains intact — but the near-term upside may be thinner than the recent rally suggests.