SAP's Recovery Narrative: Security Scrutiny Meets a Deepening Buyback and a Cloud Backlog Doing the Heavy Lifting

SAP shares surge on robust cloud bookings and buybacks, yet active exploits and a 9.9 CVSS flaw test the bullish narrative.

The recent stretch of trading has been kind to SAP shareholders, with the stock climbing roughly 36 percent over the past month to close Wednesday at 184.86 euros. Yet that rebound — built on a foundation of robust cloud bookings and the closure of a regulatory overhang — is unfolding against a steady drumbeat of security advisories that keep testing the narrative of a company firing on all cylinders.

The latest of those advisories arrived this week with researchers flagging active exploitation attempts against the SAP Commerce Cloud via a vulnerability tracked as CVE-2026-58231. Adding to the concern, a critical flaw in the SAP MII component has been disclosed with a CVSS score of 9.9, the highest severity band. The company has yet to issue a final statement on the matter. The disclosures follow the August 12 patch day, when SAP published 28 new security notes, five of them carrying the top "HotNews" priority designation. The next scheduled patch cycle lands on September 9.

For investors, the security chatter is less a trigger for selling than a reminder of the maintenance intensity baked into SAP's sprawling software estate. The operational picture, after all, remains decidedly constructive.

The Numbers Behind the Bounce

The second quarter delivered revenue of 9.88 billion euros, up 9.42 percent year over year, with IFRS earnings per share climbing to 1.89 euros from 1.46 euros in the prior-year period. Management reaffirmed its full-year guidance for non-IFRS operating profit in a range of 11.8 to 12.2 billion euros. The third-quarter report is slated for October 21.

The cloud engine continues to supply the momentum. The cloud order backlog expanded 27 percent to 22.9 billion euros, or 26 percent on a currency-adjusted basis. Cloud revenues grew 22 percent, with the cloud ERP suite segment advancing 25 percent. Those figures have helped offset a share price that remains roughly 23 percent below its 52-week high of 242.00 euros, set on October 23.

Recent acquisitions are expected to modestly dilute this year's operating result by more than 100 million euros, but they are aimed squarely at deepening SAP's AI capabilities. Dremio contributes a data lakehouse platform designed to integrate SAP and non-SAP data, while Prior Labs brings tabular foundation models for structured business data. SAP is investing over one billion euros across four years in the latter, with Prior Labs continuing to operate as a standalone entity.

Buyback Machine Keeps Running

The share repurchase program remains a steady feature of the tape. Between August 3 and 7, SAP acquired roughly 2.9 million of its own shares at an average price of 169.72 euros. The following week, from August 10 to 14, it added another 50,000 shares via Xetra. That brings the cumulative total of the current program — which is slated to reach 10 billion euros by the end of 2027 — to more than 5.12 million shares repurchased.

The buyback signals management's conviction in the company's valuation and provides a supportive bid in a period when the stock is still trading well off its highs.

Analyst Divergence and Regulatory Relief

The analyst community is sending mixed signals. The Erste Group Bank raised its 2026 earnings estimate for SAP on Tuesday, even as Berenberg, Barclays, Bernstein, and Citi have trimmed price targets in recent weeks. The average target across the Street now sits at 193.92 euros. Berenberg cut its target from 215 to 205 euros in mid-August while maintaining a "Buy" rating. Barclays, which reduced its target from 255 to 220 euros in late July, kept its "Overweight" stance, citing short-term cost uncertainties but noting the cloud pipeline came in stronger than expected.

On the regulatory front, the Bundeskartellamt has closed its preliminary review of SAP's maintenance and support policies for on-premise solutions without launching a formal abuse proceeding. The European Commission had previously wrapped up its own examination of the same policies. Both outcomes remove a layer of uncertainty that had weighed on the valuation of the on-premise business.

Customer Wins and the Path Forward

Operationally, the expansion continues. Dutch shipbuilder Damen Shipyards has selected SAP Business AI and the S/4HANA platform to improve processes and data quality in its spare parts business. Wins like this reinforce a cloud backlog that has become the central pillar of the recovery story.

The stock's recent run — up 1.6 percent on Wednesday alone, and now trading about 7.8 percent above its 50-day moving average of 172.02 euros — reflects the convergence of strong cloud fundamentals, regulatory clarity, and ongoing buyback support. Year-to-date, however, the shares still sit 12 percent in the red, a reminder of how deep the earlier sell-off ran. For now, the balance between operational strength and the recurring security headlines remains the defining tension for the stock.