SAP's Triple Threat: AI Cost, Stock Rout, and Maximum-Severity Security Flaws

Mixed Q2 2026 Results

SAP's Q2 2026 results, also released on July 23, painted a split picture :

The good:

• Cloud revenue rose 24% to €6.28 billion
• Current cloud backlog surged 27% to €22.9 billion
• Non-IFRS operating profit rose 7% (9% at constant currencies) to €2.74 billion

The less good:

• Adjusted EPS came in at $1.82 versus analyst estimates of $2.03
• Total revenue of €9.88 billion ($11.24 billion) narrowly missed consensus
• Non-IFRS operating profit fell short of analyst expectations despite the year-over-year increase

CEO Christian Klein highlighted that "Q2 was another strong quarter, highlighted by sustained current cloud backlog and free cash flow growth against a volatile macroeconomic backdrop" . However, the earnings miss added to investor skepticism.

Sharp Stock Decline and Partial Recovery

SAP shares have been under severe pressure through much of 2026:

• January 2026 selloff: Shares fell 15% in a single day on January 29 after cloud revenue forecasts disappointed, marking the steepest one-day decline since October 2020 .
• Broader AI-driven rout: Earlier in January, SAP shares hit a 17-month low in an AI-driven selloff that erased roughly $130 billion in market value from the prior peak .
• Year-to-date performance: SAP shares were down roughly 29–37% year-to-date through mid-2026 .
• Post-Q2 reaction: After the July 23 earnings release, shares fell 1.79% in regular trading but recovered 1.46% after hours, suggesting some investor relief that the cloud growth narrative remained intact despite the profit trim .

Analyst sentiment remains mixed. Morningstar sees the stock as undervalued with a wide-moat rating, while other analysts have trimmed price targets amid concerns about AI spending and margin pressure .

Two Critical Security Vulnerabilities (August 2026 Patch Day)

Adding operational and reputational pressure, SAP's August 2026 Security Patch Day disclosed 30 security notes, including two critical flaws :

CVE-2026-58231 (CVSS 10.0) — SAP Commerce Cloud

This is a maximum-severity improper authorization vulnerability in SAP Commerce Cloud (Data Hub Adapter), affecting COM_CLOUD versions 2211 and 2211-JDK21. An unauthenticated attacker can abuse a default authentication client and submit specially crafted input to achieve arbitrary code execution .

According to SAP Security Note #3771065, the flaw stems from insufficient authorization checks and input validation .

CVE-2026-44764 (CVSS 9.9) — SAP Manufacturing Integration and Intelligence

This vulnerability involves a missing authorization check in SAP Manufacturing Integration and Intelligence. An unauthenticated attacker can send crafted requests to the Cost Servlet using specific parameter values, enabling access to backend operations. Successful exploitation could allow the attacker to read, create, modify, or delete application-managed business data .

The NVD entry confirms this is a "Missing Authorization Check" vulnerability that could lead to data access or modification .

SAP has released patches for both vulnerabilities . Customers using affected versions should prioritize these updates, especially the Commerce Cloud flaw which carries the highest possible CVSS rating.

The Bigger Picture: What These Challenges Mean

Taken together, these issues represent a stress test for SAP's transformation strategy. The profit guidance cut and stock decline reflect the market's impatience with the near-term cost of AI investment, even as cloud growth remains strong. The security vulnerabilities add operational risk at a time when investor focus is already trained on execution.

For CIOs and SAP customers, the key takeaways are straightforward:

• Financial health: SAP's core cloud business remains healthy, with 24% revenue growth and a €22.9 billion backlog. The profit trim is a tactical M&A cost, not a demand signal.
• Security posture: The August 2026 patch day should be treated as urgent. CVE-2026-58231 (CVSS 10.0) in Commerce Cloud is as severe as it gets—patch immediately.
• Stock volatility: The 29-37% YTD decline reflects sentiment and AI spending concerns rather than deteriorating fundamentals, but investors should watch Q3 2026 for signs of operating leverage improvement.