SAP's Patch-Day Paradox: Record Cloud Backlog Meets a Perfect-Ten Flaw
Published on 09/10/2026 at 09:10 | Editorial boerse-global.de
SAP pushed out 19 new security advisories on Tuesday as part of its monthly patch cycle, and four of them carry severity scores of 9.0 or above. The standout is CVE-2026-44756, which earns a CVSS rating of 10.0 — the highest mark the scoring system awards — and touches memory handling in both the SAP Kernel and the Web Dispatcher.
The flaw sits in the processing of so-called Extended Passports, an internal data format that the Kernel and Web Dispatcher use to talk to one another. A missing authentication check in the NetWeaver Message Server rounds out the most serious of the batch, while other fixes span NetWeaver, S/4HANA, the Integration Suite, SAPUI5, the ABAP Developer Tools, the NetWeaver Business Client, and Commerce Cloud Search and Navigation. For enterprises running SAP on-premise or in the cloud, the steady drumbeat of such disclosures translates into mounting patch-management overhead — a burden the software industry shares, though SAP's sprawling customer base makes it feel the pinch more acutely.
Cloud Momentum Keeps Rolling
None of that appears to have slowed the commercial engine. Lockheed Martin has signed on to SAP SuccessFactors Solutions as it reshapes its workforce, and HARTING, the electrical engineering group, said in early September that it would press ahead with its cloud transformation via RISE with SAP. Those reference wins land alongside hard numbers: the cloud backlog reached EUR 22.9 billion by the end of July, up 27 percent, while cloud revenue climbed 24 percent at constant currency and the cloud ERP suite business advanced 27 percent.
Management did trim its profit guidance for the year, citing dilution from the Dremio and Prior Labs acquisitions, nudging the non-IFRS figure to a range of EUR 11.8 billion to EUR 12.2 billion.
Should investors sell immediately? Or is it worth buying SAP?
A Stock Still Searching for a Floor
The equity tells a different story. SAP closed Wednesday at EUR 180.18, off 0.9 percent on the day, down 3.2 percent over the week and 14 percent year-to-date. Over twelve months the decline reaches 19 percent, and the shares now sit 26 percent below their 52-week high of EUR 242.00, set in October 2025.
That weakness reflects a longer repricing tied to questions about SAP's AI roadmap. UBS cut its rating from Buy to Neutral on Wednesday, August 26, while simultaneously lifting its price target from EUR 164 to EUR 201 — a combination that suggests the valuation debate is more nuanced than a straightforward sell signal. The Swiss bank pointed to slower-than-expected customer adoption of AI projects and softening cloud growth. Market watchers also flagged broader pressures such as oil prices and interest rates. With the downgrade now two weeks old, it no longer qualifies as a fresh trigger for the current price action.
Leadership Continuity, With One Asterisk
On the management front, August brought reassurance and a small question mark. CEO Christian Klein extended his contract through April 2030, while CFO Dominik Asam opted to stay only until 2028 — read by the market as stability with an unresolved succession question on the finance side.
SAP is also keeping its customer conversation going. The SAP NOW AI Tour Brazil 2026 was scheduled for September 9 and 10 in São Paulo, with artificial intelligence, data management, and business transformation topping the agenda.
For investors, the picture splits cleanly. Cloud operations are expanding briskly and marquee names keep deepening their SAP deployments. At the same time, a maximum-severity vulnerability is testing short-term confidence, and a share price 26 percent adrift from its peak captures the market's lingering doubt about how quickly the AI story will actually pay off.
Ad
SAP Stock: New Analysis - 10 September
Fresh SAP information released. What's the impact for investors? Our latest independent report examines recent figures and market trends.
