SAP's October Ledger: A CVSS 10.0 Flaw, a Belgian AI Deal, and TD Cowen's Raised Bet on Cloud

TD Cowen lifted its price target on SAP from $205 to $250 on Thursday, keeping a "Buy" rating on the stock, with the brokerage pointing to sustained momentum in cloud migrations as the reason for the upgrade. The move lands in the middle of a busy stretch for the German software maker, which has spent the same week shipping security fixes, rolling out new finance tools, and lining up an acquisition.

The distinction matters for anyone reading the run of headlines. A higher target reflects an analyst's expectations, not proof of revenue or profit already booked. SAP's own announcements describe work on the product — patches, feature packs, planned purchases — and carry no financial figures of their own.

Security work takes center stage

On Tuesday, as part of its October Security Patch Day, SAP published 16 new Security Notes and four GitHub Security Advisories. The most serious item was an OAuth2-SSRF vulnerability in the SAP Cloud SDK for Python, which drew a critical CVSS score of 10.0. Critical flaws were also reported in NetWeaver Visual Composer, S/4HANA, and Manufacturing Integration and Intelligence — so the exposure is not confined to a single product line.

That disclosure concerns vulnerabilities and their fixes. It is not a report of business damage stemming from any of them, a line investors should keep clear when weighing the security news against the sales story.

Finance tools and the Joule rollout

Product development has continued in parallel. SAP released Cloud ERP Private 2025 Feature Pack Stack 02 on Tuesday, adding capabilities for more tightly governed business processes and for putting artificial intelligence to work. New finance functions had already arrived on October 6, including embedded payments, consolidation features, and expanded AI capabilities, alongside SAP Enterprise Financial Consolidation and additional Joule Assistants for finance, governance, and compliance work.

Those assistants build on Joule Work, the AI working surface SAP presented at its SAP Connect event on October 6 and has begun rolling out to customers. The implementation status differs across the portfolio: Joule Work is in rollout, while SAP Pay and the extra finance offerings have so far only been announced. Announced products are not the same as fully deployed ones, and none of the announcements on its own establishes added revenue.

A Belgian acquisition on the calendar

Also on October 6, SAP said it had agreed to acquire TechWolf, a Belgian AI company. The deal is slated to close in the fourth quarter of 2026, subject to regulatory approvals among other conditions.

What October 21 will settle

The next hard checkpoint is scheduled: SAP will report third-quarter 2026 results after the market close on October 21, with an investor and analyst call set for 23:00 CEST. Until those figures land, TD Cowen's call stands as a vote of confidence in cloud demand, while the patch work and product releases represent concrete labor on the offering — a different yardstick altogether. Whether the optimistic business outlook holds up is a question only the quarterly numbers can answer.