Cisco ships the password, the market pays the multiple

An admin door with no workaround

On 30 September Cisco told customers that attackers are already exploiting the software that runs their wide-area networks ¹². CVE-2026-76504, rated 9.8, lets an unauthenticated stranger use the Catalyst SD-WAN Manager API with full admin rights by encoding one character of a login request ¹³. There is no workaround, the flaw surfaced through a routine support case, and CISA ordered federal agencies to patch by 3 October↗ ¹²³.

It is the fifth Cisco SD-WAN zero-day exploited this year, and the third critical unauthenticated authentication flaw in that product since February ¹². Three weeks earlier, on 9 September, Cisco's own Talos unit traced three intrusion clusters in Secure Firewall Management Center, the console that manages customers' firewalls: Qilin ransomware operators who came in through the shipped-in password, and a crew whose tooling overlaps Russia's Sandworm ⁴⁵⁶.

A 31.8x multiple on 6 percent

The market prices Cisco as an AI stock: a 61 percent one-year return, and 31.8 times trailing earnings against 21.9 for the S&P 500 ⁷. That premium has room for little to go wrong ⁷.

The filings price it otherwise. AI infrastructure delivered about $4 billion of fiscal 2026's $63.3 billion revenue, roughly 6 percent; the $7.5 billion expected this year is guidance ⁸⁷. The final quarter grew 18 percent on product orders up 35 percent, and management said price rises on memory-heavy hardware added about 5 points ⁸⁷.

Fiscal 2027 is guided to $72.2 billion to $73.4 billion, with growth outside AI near 10 percent against the 12 and 18 percent quarters it must lap ⁸⁷. Piper Sandler cut its target to $125 in late September↗ on concern that growth is peaking ⁷.

The pattern the pledge didn't break

Cisco signed CISA's Secure by Design pledge in May 2024↗, which asks signers to show measurable progress within a year toward cutting default passwords; it is voluntary and unverified ⁶. The advisories kept landing: hard-coded credentials flagged in 2018 and 2021, an unchangeable root account in Emergency Responder in 2023, a 9.8-rated static administrator login in Smart Licensing Utility in September 2024, five static Firepower accounts a month later ⁶.

The record cuts both ways. Cisco names the weakness, ships fixes, publishes indicators, and a vendor that digs into its own products will find flaws ⁶. Scale is the uncomfortable part: since November 2021 CISA has tagged 90 Cisco vulnerabilities as exploited in the wild, seven of them abused by ransomware crews ².

The same budget, other bidders

The payer is the enterprise or telco CISO renewing security contracts with the vendor whose own incident reports name the way in, on hardware that just took a memory-price increase ⁵⁶⁷. CISA's catalog lists 15 hard-coded or default-credential entries from 13 vendors, so the grass is not automatically greener ⁶.

Across the street the trade is cleaner. CrowdStrike and Palo Alto have more than doubled in six months as the AI cybersecurity trade begins, at roughly 208 and 93.5 times forward earnings, into a market Gartner sees climbing from $51.3 billion this year toward $86 billion in 2027 ⁹. CrowdStrike posted record net new annual recurring revenue of $333 million last quarter↗; Palo Alto's next-generation security ARR rose 63 percent to $9.10 billion ⁹¹⁰.

A miss is the early warning

Nothing yet ties these advisories to a lost renewal; that part is unproven. The first hard reading is the fiscal Q1 2027 report against the $18.0 billion to $18.2 billion guide↗, where a miss is the early warning on the full-year outlook ⁸⁷.

Until then the record says: the password was in the product, and the premium is in the price.