SAP's August Balancing Act: A Maximum-Severity Security Patch Meets a Buyback Program Gaining Momentum

SAP shares recover 36% in a month despite critical CVSS 10.0 flaws; analysts split, buyback supports stock.

The software giant's shares closed at 185.48 euros on Wednesday, up 2.0 percent on the day, extending a recovery that has lifted the stock roughly 36 percent over the past month. That puts the equity comfortably above its 50-day moving average of 172.02 euros, though it still sits about 23 percent below the 52-week high of 242.00 euros reached on October 23.

A Patch Day With Maximum Severity

The rally has unfolded against a backdrop of routine — but demanding — security maintenance. On August 11, SAP released 28 new security notes alongside one GitHub security advisory and updates to two existing notes. Among them, four vulnerabilities carry critical ratings, with the most severe — CVE-2026-58231, affecting the Data Hub Adapter of SAP Commerce Cloud — earning the maximum CVSS score of 10.0. Additional critical flaws were identified in SAP Manufacturing Integration and Intelligence (CVE-2026-44772) and the NetWeaver/ABAP platform (CVE-2026-34265).

Security firm Onapsis counts 33 new or updated notes in total, including five "HotNews" alerts and nine high-priority items — a slightly higher tally than SAP's own accounting, a discrepancy that underscores the breadth of affected systems, from cloud applications to the legacy ABAP foundation. A maximum-severity rating typically signals that attackers could exploit the flaw remotely without special privileges, a scenario that typically forces IT teams to move quickly.

Analyst Divergence and a Raised Estimate

The security bulletin lands amid a mixed bag of analyst sentiment. Erste Group Bank raised its 2026 earnings estimate for SAP on Tuesday, while several other houses — including Berenberg, Barclays, Bernstein, and Citi — have trimmed their price targets in recent weeks, though most retain buy ratings. The average analyst target currently stands at 193.92 euros.

Barclays, which cut its target from 255 to 220 euros in late July, maintained its "Overweight" stance, citing short-term uncertainty around cost development but noting that the cloud order pipeline came in stronger than expected. The divergent signals reflect a company that is executing well operationally while drawing scrutiny over margins and integration costs tied to recent acquisitions.

Buyback Program Steadies the Stock

Meanwhile, SAP continues to buy back its own shares. During the week of August 10-14, the company purchased another 50,000 shares via the Xetra exchange, pushing the total repurchased under the current program — which is slated to reach 10 billion euros by the end of 2027 — past 5.12 million shares. The ongoing buyback signals management's confidence in the company's valuation and provides a measure of demand support at a time when the stock remains well off its highs.

Cloud Momentum and the AI Investment Bet

The foundation for the more optimistic assessments lies in the second quarter. SAP reported a 27 percent increase in cloud backlog to 22.9 billion euros (26 percent on a currency-adjusted basis), with cloud revenues growing 22 percent and the cloud ERP suite business up 25 percent. Total revenue rose 9 percent to 19.432 billion euros, while the IFRS operating result climbed 12 percent to 5.383 billion euros. Earnings per share advanced 19 percent to 3.55 euros.

For 2026, SAP updated its non-IFRS operating result guidance to a range of 11.8 to 12.2 billion euros, with the recent acquisitions of Dremio and Prior Labs expected to dilute results by more than 100 million euros. Those purchases are aimed at expanding SAP's AI capabilities: Dremio offers a data lakehouse platform for integrating SAP and non-SAP data, while Prior Labs develops tabular foundation models for structured business data. SAP is investing more than one billion euros in the latter over four years, keeping Prior Labs as an independent entity.

Regulatory Uncertainty Cleared

On the regulatory front, the picture has brightened. In late July, Germany's Federal Cartel Office declined to open proceedings against SAP's maintenance and support policies for on-premise solutions, approving them instead. That followed the European Commission's earlier closure of its review of the same policies — decisions that remove a lingering overhang on the valuation of the on-premise business.

For investors, the current landscape is twofold: the cloud-driven operational story remains compelling, while the monthly cadence of critical security patches serves as a reminder of the complexity — and vulnerability — inherent in large enterprise software environments. The patch notes merit prompt attention from those running SAP systems, even if the security news itself appears to be more of a maintenance signal than a near-term driver for the share price.