SAP's Patch-Day Tally: A Perfect-Ten Flaw, a UBS Downgrade in the Rearview, and a Stock 26% Off Its High
Published on 09/10/2026 at 13:21 | Editorial boerse-global.de
SAP pushed out 19 new Security Notes on its September Patch Day, and the headline number is hard to ignore: one vulnerability carries a CVSS score of 10.0, the maximum severity rating the industry uses. The flaw, tracked as CVE-2026-44756, is a memory-corruption weakness in the Extended Passport Processing function. It is not alone. Security researchers also flagged a missing authentication check in the NetWeaver Message Server, scoring 9.8, and an access-control gap in SAP GUI for Java at 9.0. A credential-disclosure issue in the Cloud Application Programming Model, rated 9.4, reaches into current versions of the sap/cds-mtxs package.
The September cycle also swept through NetWeaver, S/4HANA, the Integration Suite, SAPUI5, the ABAP Developer Tools, the NetWeaver Business Client, and Commerce Cloud Search and Navigation. For enterprises running SAP systems on-premises or in the cloud, the steady drumbeat of critical advisories translates into a recurring patch-management burden — a chore the software industry shares, but one that lands with particular weight on a vendor with SAP's customer footprint. Repeated maximum-severity disclosures inevitably raise questions about the security architecture of certain core components, even when the company moves quickly to close the gaps.
The Numbers Behind the Noise
Operationally, the picture looks considerably brighter. Current Cloud Backlog climbed 27% in the second quarter to EUR 22.9 billion, cloud revenue advanced 22%, and the Cloud ERP Suite segment grew 25%. SAP nudged its 2026 guidance for non-IFRS operating profit to a range of EUR 11.8 billion to EUR 12.2 billion, a revision that accounts for dilution from the completed acquisitions of Dremio and Prior Labs. The purchase of Prior Labs, a Freiburg-based AI specialist focused on Tabular Foundation Models, comes with a pledge to invest more than EUR 1 billion over the next four years.
Leadership continuity is locked in as well. CEO Christian Klein extended his contract through April 2030, while CFO Dominik Asam will stay on until 2028 at his own request. And Lockheed Martin's partnership with SAP SuccessFactors on workforce transformation offers a reminder that large customers are not walking away.
Should investors sell immediately? Or is it worth buying SAP?
A Downgrade That Has Aged
Analyst sentiment took a hit in late August, when UBS cut its rating on SAP from Buy to Neutral on Wednesday, August 26 — while simultaneously lifting its price target from EUR 164 to EUR 201. The bank pointed to slower-than-expected implementation of customer AI projects and softening cloud growth. Shares came under pressure afterward, with market watchers also citing broader drags such as oil-price and interest-rate worries. Two weeks on, that downgrade no longer qualifies as a fresh catalyst for the stock's current moves.
Price Action Tells Its Own Story
The equity has been drifting lower. SAP closed Wednesday at EUR 180.18 after a 0.9% daily decline, then gave up another 1.3% on Thursday to trade at EUR 177.88. Over the past week the stock has shed 4.5%. Year-to-date it is down 14% to 15%, and on a twelve-month view it has lost 19%. The gap to its 52-week high of EUR 242.00, set last October, now stands at 26% — a stark contrast to the double-digit growth rates still coming out of the cloud business.
Meanwhile, SAP kept its customer-facing AI messaging front and center. The SAP NOW AI Tour Brazil 2026 was scheduled for September 9 and 10 in São Paulo, with artificial intelligence, data management, and business transformation topping the agenda.
For investors, the mix remains genuinely complicated: solid operating figures and a CEO signed through 2030 on one side, recurring security warnings that can erode confidence in software quality on the other. The strategic debate over the pace and reach of SAP's AI transformation is doing more to shape the share price than any single patch bulletin.
Ad
SAP Stock: New Analysis - 10 September
Fresh SAP information released. What's the impact for investors? Our latest independent report examines recent figures and market trends.
