SAP's Cloud Engine Outpaces Guidance Trim as a Maximum-Severity Security Flaw Tests the Rally

SAP's Q2 cloud revenue jumps 24%, but AI acquisition costs trim profit outlook and a CVSS 10.0 vulnerability sparks urgent patching.

The market's reaction to SAP's second-quarter numbers tells a story of competing forces: a cloud business firing on all cylinders, an acquisition-driven dent in profitability, and a security vulnerability that has put customers on high alert. The shares closed Friday at €179.80, down 0.7 percent on the day, yet the 30-day picture shows a 32 percent advance — a recovery that has largely priced in both the Q2 beat and the recent closure of cartel preliminary proceedings.

That rally has been built on a simple foundation. Cloud revenue climbed 24 percent on a currency-adjusted basis to €6.28 billion, while the cloud order backlog expanded 26 percent to €22.9 billion. Total sales of €9.878 billion edged past the consensus estimate of €9.85 billion, and earnings per share jumped from €1.45 to €1.89, comfortably ahead of the €1.76 analysts had penciled in.

The Cost of Buying AI Muscle

The headline numbers, however, mask a margin story that has split the analyst community. SAP's full-year operating profit guidance, measured on a non-IFRS basis, now sits between €11.8 billion and €12.2 billion — a range that already absorbs more than €100 million in integration costs tied to the recently completed acquisitions of Dremio and Prior Labs. Both deals, finalized in July, are designed to bolster the company's AI capabilities, but they dilute margins in the near term.

That dilution prompted a modest trimming of the profit outlook, a correction that some on the Street view as manageable given the strength of the underlying business. Others are less forgiving. JPMorgan described the margin development in the second quarter as a negative surprise, while the divergence in price targets tells its own tale. Goldman Sachs' Mohammed Moawalla reaffirmed a "Buy" rating with a €215 target — albeit lowered from €230 — citing a robust product pipeline despite macroeconomic headwinds. UBS's Michael Briest also stuck with "Buy" but left his target at €164, a level well below the current share price and a signal of considerably more caution about upside potential.

A Perfect-Score Vulnerability

The operational narrative has been complicated by a security issue that carries the maximum possible severity rating. SAP disclosed 28 security notes during its monthly Patch Day last Tuesday, the most critical of which affects the Commerce Cloud Data Hub Adapter. The flaw, tracked as CVE-2026-58231, has been assigned a CVSS score of 10.0 — the highest criticality level — and is already being actively exploited, just days after the vendor shipped a fix.

The vulnerability stems from missing authorization checks and insufficient input validation, allowing attackers to execute malicious code. The perpetrators behind the campaign remain unidentified, though SAP's history of security incidents includes both espionage activity linked to China and conventional cybercrime. Customers running affected cloud commerce installations are being urged to apply the patch immediately; the next regularly scheduled Patch Day falls on September 9.

Strategy Beyond the Balance Sheet

CEO Christian Klein has been vocal about the urgency of the AI transition, warning in a recent interview with the Süddeutsche Zeitung that SAP cannot afford to fall behind competitors like Anthropic or the US hyperscalers in business-process AI. That sense of urgency explains the dual-track approach: acquisitions on one side, partnerships on the other. US-based Veritone confirmed during its latest quarterly report that its subsidiary Broadbean is deepening collaboration with SAP, integrating its offerings into the SAP talent management system through the PartnerEdge Build program.

For investors, the near-term markers are clear. The next Patch Day on September 9 will show how quickly the Commerce Cloud issue is contained, while third-quarter results on October 21 will reveal whether cloud growth can continue at this clip and how heavily the AI-related integration costs actually weigh on margins. The stock, despite its recent bounce, remains roughly a quarter below its 52-week high of €242.00 set last October and is still down 14 percent year-to-date — a reminder that the market's enthusiasm has its limits.