One email takes over Cisco's email gateway a third time as buy intent for its security falls to 47% from 57%

One email, root access, again

Cisco's·−2.28% — Cisco, down 2.28 percent as of its last quote Secure Email Gateway, the appliance that screens malicious mail before it reaches corporate inboxes, can be taken over by the very thing it exists to stop. The newest flaw, CVE-2026-76519, the industry catalog number for the flaw↗, scored 9.8 of 10 and lets an unauthenticated attacker write files and run commands with root privileges, full control of the appliance, after emailing one crafted attachment ¹³.

There are no workarounds ¹³. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its exploited-vulnerabilities catalog↗ on October 14 and set federal agencies a October 17 deadline ⁴. Cisco says a limited number of customers are affected and declined to say how many appliances were compromised ¹. The money signal landed the same week: intent to buy Cisco security products fell to 47% from 57% in one quarter in Morgan Stanley's▼−0.84% — Morgan Stanley, down 0.84 percent today CIO survey↗ ².

Three flaws, ten months, ten points

Three root-by-email flaws have hit this one product line in ten months. January's CVE-2025-20393, a perfect 10, was exploited to install persistence; a suspected Chinese-nexus group planted backdoors and purged logs, with attacks running since November 2025 ¹⁶⁷. September's CVE-2026-76461, an SQL injection in the email parser↗, also ended in root commands ⁷.

Security remained the strongest spending category even as intentions moderated, and Cisco held its place as CIOs' top networking pick, analyst Meta▼−3.61% — Meta, down 3.61 percent today Marshall wrote ². The cooling was broad: network security spend intentions eased to +70% from +85%, and net vendor spend intentions fell to +28% from +57% ².

The fix shipped a month before the alarm

Fixes for the October flaw shipped on September 14 under a different catalog number, CVE-2026-76440, and Cisco updated its advisory on October 14 to disclose the in-the-wild exploitation↗ ⁵. The bug was found by Cisco's own internal security scanning ³.

Buyers were already stretching. Project delays climbed to 13% from 2% in one quarter, and 83% of CIOs reported 1–10% equipment price increases; 40% said further increases would delay purchases ².

The record quarter pays for the stumbles

The counterweight is real. Cisco's July quarter, its fiscal fourth↗, set a revenue record of $17.3 billion, up 18% year over year, and security revenue rose 14% on strength in Splunk, the data platform Cisco acquired ⁸. For fiscal 2027, management projects security and observability growth accelerating from low single digits to high single digits ⁸.

The bull case has survey support too: 31% of Splunk noncustomers reported an improved view of Cisco's offering, up from 24% ². Holders of CSCO carry the security-growth premium; rival security vendors stand to gain at renewal. The survey shows the opening, with Cisco retention softened to 63% from 68% ². No source ties the three flaws to actual renewals; whether the ten lost points of purchase intent reach revenue is untested.

Watch for incident reports, not patches

Saturday's October 17 deadline passes with the catalog listing ransomware use of the flaw as unknown, so watch for incident reports rather than patches ⁴. Nearly 300 gateway instances sit exposed online, by the security watchdog Shadowserver's count↗ ⁶. Morgan Stanley kept its Overweight rating, its buy-equivalent, with a $135 target ². The next CIO survey reading and Cisco's next earnings report will show whether ten lost points of intent was noise or the renewal cycle starting to turn.