SAP's Two-Front Headache: A €200 Million Client Exit Overshadows Security Patches and Insider Confidence

SAP patches critical flaws as Zeiss abandons €200M S/4Hana project, raising cloud execution doubts despite insider buying.

The software giant's Tuesday patch release — which included three vulnerabilities carrying the maximum CVSS risk score of 10.0 — arrived at an awkward moment for a company already fielding questions about its ability to deliver on large-scale cloud transformations. The affected components span the Extended Passport Processing module, the NetWeaver platform, and the Cloud Application Programming Model, areas that sit at the heart of enterprise operations for thousands of corporate customers.

For a vendor whose code underpins mission-critical processes across much of the corporate world, maximum-severity flaws are hardly a peripheral concern. Clients now face the familiar scramble to deploy fixes before attackers probe exposed production systems, and the recurring appearance of critical holes in foundational infrastructure like NetWeaver keeps alive a nagging question: just how resilient are SAP environments against targeted intrusion? It is a line of inquiry that carries growing weight as the company pushes its cloud agenda.

A High-Profile Retreat

The security bulletin, however, was not the only cloud on the horizon. Zeiss has pulled the plug on a major SAP implementation built around a greenfield approach — a project that had already consumed more than €200 million. The Oberkochen-based optics group's decision to abandon the undertaking marks an awkward setback for SAP, coming as it does in a period when the company is leaning heavily on exactly such transformation deals to fuel its subscription growth narrative.

Greenfield deployments are widely regarded as the most demanding route to S/4Hana, requiring customers to rebuild processes from scratch rather than migrate existing landscapes. When a project of this scale collapses after costs of that magnitude, it inevitably raises questions about execution capability — particularly for a vendor marketing such overhauls as a primary engine for cloud expansion.

The contrast with another ongoing engagement is instructive. IT services firm CBS is constructing an S/4Hana platform for chocolate maker Ritter Sport, blending an on-premise digital core with cloud analytics and scheduled rollouts across Europe and Asia. The multi-year mandate suggests customers remain willing to commit to SAP modernisation — though outcomes, evidently, vary.

Market Reaction and the Broader Sell-Off

The Zeiss news landed in an already fragile trading session. SAP shares fell 2.0 percent to €181.90 in afternoon XETRA dealings on Monday, touching a low of €179.92 after opening at €183.56. The stock closed the day down 1.5 percent at €182.26, leaving it among the DAX's weakest performers with a 1.9 percent deficit relative to the index.

The broader tape offered little shelter. The DAX slipped 0.4 percent to 25,953 points, sliding beneath the 26,000 threshold. Semiconductor names such as Infineon drew strength from upbeat US and Asian cues, gaining as much as 3.3 percent, while Brent crude hovering near the $100 mark and market pricing of a possible 25-basis-point European Central Bank rate hike to 2.5 percent added to the cautious mood.

Year-to-date, SAP now shows a decline of 13 percent, extending to 21 percent on a twelve-month view.

Insider Buying and Buybacks Tell Another Story

Yet against this backdrop of client defections and analyst scepticism, signals from inside the company point in a different direction. Management has been active buyers of their own stock: CEO Christian Klein acquired shares worth roughly €325,000 in late July, Chief People Officer Gina Vargiu-Breuer followed in August, and Chief Customer Officer Thomas Saueressig purchased €267,450 worth through the Düsseldorf exchange at €178.30 per share at the end of that month. Such insider activity hardly substitutes for fundamental analysis, but it does suggest confidence at the executive level.

The €10 billion share repurchase programme, running through 2027, continues apace. By the end of June, SAP had bought back over 16.2 million shares at an average price of €161.16, with a further 2.9 million or so added in early August at an average of €169.72.

Analysts Split, Fundamentals Hold

The equity story remains a study in conflicting signals. Santander downgraded SAP from "Outperform" to "Market Perform" last Sunday, and the stock has shed 1.6 percent since. That followed UBS's late-August move to "Neutral" from "Buy" — though the Swiss bank simultaneously lifted its price target from €164 to €201. The divergent views capture a broader debate over how much further SAP's cloud momentum can accelerate after second-quarter figures showed currency-adjusted cloud revenue growth of 24 percent and a current cloud backlog of €22.9 billion.

The fundamentals, at least, remain solid. Second-quarter 2026 earnings per share came in at €1.89, up from €1.46 a year earlier, while revenue advanced 9.42 percent to €9.88 billion. The dividend for 2025 stood at €2.50, with analysts pencilling in €2.66 for 2026.

The stock currently trades at €182.04, essentially flat against the prior session's €182.26 close. It has recovered 43 percent from its July 23 yearly low but remains 25 percent below the €242.00 52-week peak reached in October. The July acquisition of foundation-model specialist Prior Labs — which SAP plans to fund with over €1 billion across the next four years — has contributed a 31.4 percent gain to the share price since its announcement.

Investors will get their next opportunity to press management on how much damage lost mandates like Zeiss could inflict on cloud growth when quarterly figures arrive on October 21. For now, the security patches represent operational routine for customers — significant for those running affected systems, but unlikely to move the needle on the strategic narrative. The Zeiss retreat, by contrast, cuts closer to the bone.