SAP's Buyback Machine Keeps Humming While a Perfect-Ten Flaw Lands on Patch Day

SAP shipped 33 security items, seven rated HotNews, as cloud revenue rose 22% and buybacks continued. Q3 results are due October 21.

SAP's monthly Security Patch Day has once again put enterprise customers on notice. The Walldorf-based software giant rolled out 19 fresh Security Notes alongside 14 updated advisories this week — 33 items in total, seven of which carry the dreaded HotNews severity tag with CVSS scores of 9.0 or above. Two of those hit the absolute ceiling of 10.0.

Among the most alarming is CVE-2026-44756, a critical vulnerability in Extended Passport Processing that earned the maximum possible rating. For organizations running SAP as the backbone of their operations, the message is blunt: patch prioritization just got harder again.

Cloud Momentum and an AI Bet Worth Billions

The security headache arrives at an awkward moment — one where SAP's core business is actually performing well. The company reported a 22% jump in cloud revenue for the second quarter, or 24% at constant currencies, with the cloud backlog swelling 27% to EUR 22.9 billion. Management adjusted its 2026 operating profit outlook to EUR 11.8–12.2 billion on a non-IFRS basis, while keeping the cloud revenue guidance at EUR 25.8–26.2 billion.

SAP isn't standing still on the innovation front either. July brought the completion of two strategic acquisitions: Prior Labs, a pioneer in tabular foundation models, and Dremio, which offers an open data-lakehouse platform. The company plans to pour more than EUR 1 billion into Prior Labs over the next four years, aiming to turn it into a leading hub for AI applications built on structured data. Both deals will weigh on operating profit in the near term, with an estimated dilution effect exceeding EUR 100 million — a cost SAP has already baked into its guidance.

Buybacks Roll On, Insiders Step In

Capital returns remain a central pillar of the company's playbook. Between August 31 and September 4, SAP repurchased 576,917 of its own shares for roughly EUR 107.9 million, bringing the cumulative total under the current program to 6.43 million shares. In August alone, the company added 50,000 shares, pushing the overall buyback volume past 5.12 million at a weighted average price between EUR 177.30 and EUR 182.61.

Insider activity has followed suit. One executive snapped up 1,700 shares at EUR 179.15, while BlackRock nudged its voting stake slightly higher to 6.75% early in the month. The board's commitment to the buyback — even as the stock sags — reads as a deliberate signal about underlying value.

New Logos, Persistent Doubts

On the customer front, SAP keeps stacking up wins. Lockheed Martin has tapped SAP SuccessFactors for its workforce transformation. Germany's HARTING is advancing its cloud migration through RISE with SAP. And NTT DATA is deploying SuccessFactors alongside the Joule AI assistant for a global HR overhaul.

Yet the market's mood tells a different story. The stock closed Thursday at EUR 176.70, down 2.0%, as media reports pointed to lingering skepticism about how quickly SAP is integrating AI assistants into its product suite. Analysts have flagged unfinished work on that front — a concern that has little to do with the company's cloud numbers and everything to do with its competitive positioning in the AI race.

By Friday, the shares had recovered somewhat, trading at EUR 178.50 for a 1.0% gain. But the weekly picture remains soft: a 3.5% decline over five sessions, roughly flat over 30 days, and down 15% year-to-date. The stock sits 26% below its 52-week high of EUR 242.00, reached last October.

What to Watch

SAP's third-quarter results are scheduled for October 21. Until then, investors will keep weighing two competing narratives: a cloud business with a EUR 22.9 billion backlog and double-digit growth, against an AI story that has yet to convince the market it can deliver. The buyback provides a floor of sorts, but it hasn't been enough to reverse the downward drift. And with another Patch Day in the books — complete with a pair of maximum-severity flaws — the security conversation isn't going away either.