SAP's Patch Day Flags Two Critical Holes as Buyback Presses On and the Stock Sits 27% Under Its Peak

SAP released 19 security notes with two critical CVEs rated 10.0, while its buyback rolls on and AI doubts weigh on the stock.

SAP pushed out 19 new security notes plus an update on Tuesday as part of its routine monthly Patch Day, and two of the flaws carry critical ratings: CVE-2026-44756 in SAP Extended Passport and CVE-2026-58240 in the NetWeaver Message Server. A security digest circulating around the release urges customers to patch both immediately — the pair have been nicknamed OVERPASS and S4GET.

The Extended Passport Processing vulnerability stands out for its maximum CVSS score of 10.0, and notes 3747649 and 3759472 lay out the technical details behind the two critical CVEs. SAP's list also includes security note 3736494, covering a denial-of-service weakness in the SOAP adapter of SAP Process Integration. For companies running their own SAP environments, the message is to move quickly — patch cycles have long since become business as usual for the group, yet they keep drawing attention across the IT security world.

Capital Returns Continue Regardless of the Mood

Away from the security bulletins, SAP's board is still buying back stock even as the share price sags. Between 31 August and 4 September the company repurchased 576,917 of its own shares for roughly EUR 107.9 million, bringing the total under the current program to 6.43 million shares. The pace signals that management is sticking with its capital-return strategy despite the market's downbeat tone — a move meant to underscore the company's fundamental worth, even if it has not managed to halt the recent slide.

The stock closed Thursday at EUR 176.70, down 2.0% on the day, and was trading at EUR 177.32 more recently. Over seven days it has shed 4.2%, and year-to-date it is 15% cheaper. The shares now sit 27% below their 52-week high of EUR 242.00, reached last October.

AI Doubts Are Doing the Damage

What is weighing on sentiment is less about the numbers and more about SAP's positioning in the AI race. Media reports point to lingering doubts over how quickly the company is advancing its AI assistants, and analysts have flagged unfinished work on integrating those assistants into the product lineup — a theme that runs alongside genuine operational progress in the cloud business.

That cloud momentum is not in question. Lockheed Martin has signed on to use SAP SuccessFactors solutions for its workforce transformation. Germany's HARTING is driving its cloud migration with RISE with SAP, and NTT DATA is deploying SAP SuccessFactors together with the Joule AI assistant for a global HR transformation. Those reference customers make the case that SAP remains in demand for core cloud migration work — a sharp contrast with a share price dominated by AI skepticism.

A Fashion-Sector Lab and a Delhi Stage

SAP is also positioning itself as technology and innovation partner for a new retail project. N4XT and RE/DONE announced a joint "Retail Innovation Lab" by press release on Wednesday, running during New York Fashion Week in SoHo from 11 to 30 September. SAP is backing the venture with its technology as part of its Autonomous Enterprise and AI positioning, though it is not appearing as an equal project partner. On top of that, SAP leadership took the stage Friday at the SAP Now AI Tour in New Delhi — another piece of the company's communications push around AI applications and its "Autonomous Enterprise" strategy.

Investors are likely to file the retail tie-up as a footnote to that AI marketing rather than a standalone catalyst. The more consequential question is how fast SAP customers close the flaws rated critical — and whether the AI initiatives promised for the autumn show real operational substance.

What Comes Next

Third-quarter 2026 results are scheduled for 21 October. Until then, the market is expected to keep weighing solid cloud metrics against the unresolved question of how quickly SAP can turn its AI strategy into convincing product results. The running buyback remains a stabilizing factor that investors must balance against the near-term weakness — and the recurring security gaps, routine as they are, do little to improve the company's image in a rough year for the stock.