Oracle’s Record $638 Billion Backlog and $396 Million Government Win Collide With a $23.7 Billion Free Cash Flow Drain

Just as Oracle was closing a rare $396 million contract with the US government, hackers were already exploiting a critical hole in its PeopleSoft software — two weeks before the company even issued a warning. The zero-day vulnerability, which allows remote code execution without authentication, has been weaponized in extortion campaigns, with 68% of targets in the education sector. It’s a stark reminder that even as Oracle flexes its deep-tech muscle, operational cracks can surface at the worst possible moment.

The government win itself is a bright spot. The US Office of Personnel Management picked Oracle over Workday, IBM, and SAP to build the first unified cloud-based HR platform for the entire federal workforce. The ten-year contract will replace more than 100 legacy systems and manage data on over two million employees. It’s a testament to Oracle’s ability to win big, complex deals against formidable rivals.

Yet such victories are being overshadowed by the sheer scale of Oracle’s infrastructure ambitions. The company now carries $638 billion in remaining performance obligations — contracted but unbilled revenue — up 363% year over year. That backlog has overtaken even Microsoft’s as the largest in tech, and it reflects an insatiable corporate appetite for AI cloud capacity. But turning that order book into cash will require a capital spending program of $70 billion, funded by $40 billion to $50 billion in debt and equity issuance planned for 2026.

The financial strain is already visible. Oracle posted negative free cash flow of $23.7 billion in the past fiscal year, a direct consequence of building out data centers in the US, Japan, and Europe. The market’s reaction has been unforgiving: the shares trade at around €160.80, roughly 43% below the September 2025 high of €280.70, and have slipped nearly 4% year to date. Meanwhile, the stock’s annualized volatility sits at 70%, and the relative strength index at 44 signals that the uncertainty has yet to be fully priced in.

A recent relief rally — the stock jumped 5.7% — came not from corporate news but from a drop in bond yields following a de-escalation in Persian Gulf tensions. Software stocks are famously sensitive to interest rate moves, and the bounce highlighted how much of Oracle’s fate now hinges on external macro factors rather than its own execution.

Should investors sell immediately? Or is it worth buying Oracle?

The leadership team that must navigate this tightrope took over in September 2025, when Safra Catz handed the CEO reins to Clay Magouyrk and Mike Sicilia. Magouyrk built Oracle Cloud Infrastructure; Sicilia knows industrial AI applications. Their mandate is brutally operational: ramp up capacity without blowing up the balance sheet, manage the dilution fear that has the stock hovering just below its 50-day moving average of €162, and prove that the $638 billion backlog can translate into margins, not just revenue.

Analysts remain broadly constructive. The consensus price target sits at around €235, implying a near-50% upside. The thesis is that once the capital intensity of this investment cycle peaks, Oracle will unleash a torrent of cash flow from its dominant AI cloud position. The backlog is the collateral; timing is the open question.

Meanwhile, the company is pushing AI features directly into vertical software. The new OPERA Cloud Assistant, offered at no extra cost, automates room assignments and pricing for hotel chains such as Wyndham, Accor, and Hyatt — Wyndham alone uses it across more than 2,100 properties. It’s a smart way to deepen customer lock-in, but it also raises the pressure on rivals and adds to the mounting expectation that every dollar of capex must deliver quick monetization.

Oracle has become a litmus test for the entire AI infrastructure thesis. The demand is real, the orders are signed, and the government has just placed a bet on its cloud. But the bill is due before the returns materialize, and a live security breach is a reminder that the company is sprinting on a path with no room for stumbles.