---
title: "One email takes over Cisco's email gateway a third time as buy intent for its security falls to 47% from 57%"
description: "One crafted email has now rooted Cisco's Secure Email Gateway three times since January, and the newest flaw landed the same week Morgan Stanley's CIO survey showed intent to buy Cisco security down ten points. Networking carried the record $17.3 billion July quarter; security grew 14%."
publisher: "The Inference"
section: "Safety"
published: 2026-10-16T18:24:47.104Z
modified: 2026-10-16T18:24:47.104Z
canonical: https://theinference.org/article/one-email-takes-over-cisco-s-email-gateway-a-third-time-as-buy-intent-for-its-security-falls-to-47-from-57
language: en
keywords: "Cybersecurity, Cisco, Enterprise Security, Earnings, Surveys"
---

# One email takes over Cisco's email gateway a third time as buy intent for its security falls to 47% from 57%

> One crafted email has now rooted Cisco's Secure Email Gateway three times since January, and the newest flaw landed the same week Morgan Stanley's CIO survey showed intent to buy Cisco security down ten points. Networking carried the record $17.3 billion July quarter; security grew 14%.

## One email, root access, again

[Cisco](https://theinference.org/markets/companies/cisco)'s Secure Email Gateway, the appliance that screens malicious mail before it reaches corporate inboxes, can be taken over by the very thing it exists to stop. The newest flaw, CVE-2026-76519, [the industry catalog number for the flaw](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp), scored 9.8 of 10 and lets an unauthenticated attacker write files and run commands with root privileges, full control of the appliance, after emailing one crafted attachment [1][3].

There are no workarounds [1][3]. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to [its exploited-vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) on October 14 and set federal agencies a October 17 deadline [4]. Cisco says a limited number of customers are affected and declined to say how many appliances were compromised [1]. The money signal landed the same week: intent to buy Cisco security products fell to 47% from 57% in one quarter in [Morgan Stanley](https://theinference.org/markets/companies/morgan-stanley)'s [CIO survey](https://seekingalpha.com/news/4653540-cisco-systems-leads-in-morgan-stanleys-cio-survey-despite-spending-moderation) [2].

## Three flaws, ten months, ten points

Three root-by-email flaws have hit this one product line in ten months. January's CVE-2025-20393, a perfect 10, was exploited to install persistence; a suspected Chinese-nexus group planted backdoors and purged logs, with attacks running since November 2025 [1][6][7]. [September's CVE-2026-76461, an SQL injection in the email parser](https://www.helpnetsecurity.com/2026/09/15/cve-2026-76461-cisco-email-gateway-zero-day-exploited/), also ended in root commands [7].

Security remained the strongest spending category even as intentions moderated, and Cisco held its place as CIOs' top networking pick, analyst [Meta](https://theinference.org/markets/companies/meta) Marshall wrote [2]. The cooling was broad: network security spend intentions eased to +70% from +85%, and net vendor spend intentions fell to +28% from +57% [2].

*Chart: **Intent to buy Cisco security fell ten points in a quarter, while campus and Splunk views rose** Range chart comparing seven CIO survey metrics between the second and third quarter 2026 Morgan Stanley surveys*

*Morgan Stanley Q3 2026 CIO survey versus the prior quarter. Net percentages of respondents, except Splunk view: share of noncustomers with an improved opinion of Cisco's offering. Source: Morgan Stanley survey via Seeking Alpha. [2]*

## The fix shipped a month before the alarm

Fixes for the October flaw shipped on September 14 under a different catalog number, CVE-2026-76440, and Cisco [updated its advisory on October 14 to disclose the in-the-wild exploitation](https://www.securityweek.com/cisco-warns-of-exploited-secure-email-gateway-vulnerability/) [5]. The bug was found by Cisco's own internal security scanning [3].

Buyers were already stretching. Project delays climbed to 13% from 2% in one quarter, and 83% of CIOs reported 1–10% equipment price increases; 40% said further increases would delay purchases [2].

## The record quarter pays for the stumbles

The counterweight is real. [Cisco's July quarter, its fiscal fourth](https://finance.yahoo.com/quote/4333.HK/earnings/4333.HK-Q4-2026-earnings_call-668273.html), set a revenue record of $17.3 billion, up 18% year over year, and security revenue rose 14% on strength in Splunk, the data platform Cisco acquired [8]. For fiscal 2027, management projects security and observability growth accelerating from low single digits to high single digits [8].

The bull case has survey support too: 31% of Splunk noncustomers reported an improved view of Cisco's offering, up from 24% [2]. [Holders of CSCO carry the security-growth premium](https://theinference.org/article/cisco-ships-the-password-the-market-pays-the-multiple); rival security vendors stand to gain at renewal. The survey shows the opening, with Cisco retention softened to 63% from 68% [2]. No source ties the three flaws to actual renewals; whether the ten lost points of purchase intent reach revenue is untested.

*Chart: **The counterweight: Cisco revenue hit a record $17.3B in the July quarter, up 18%** Column chart of Cisco quarterly revenue from Q3 2024 through Q2 2026, rising to $17.3 billion*

*Quarterly revenue by calendar quarter label; Cisco's fiscal Q4 2026 ended July 25, 2026. Source: Cisco SEC filings. [9]*

## Watch for incident reports, not patches

Saturday's October 17 deadline passes with the catalog listing ransomware use of the flaw as unknown, so watch for incident reports rather than patches [4]. Nearly 300 gateway instances sit exposed online, [by the security watchdog Shadowserver's count](https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/) [6]. Morgan Stanley kept its Overweight rating, its buy-equivalent, with a $135 target [2]. The next CIO survey reading and Cisco's next earnings report will show whether ten lost points of intent was noise or the renewal cycle starting to turn.

## Takeaway

Cisco's email gateway has been rooted three times in ten months, the newest flaw exploited as a zero-day, and CIOs' intent to buy its security fell to 47% from 57%; the record $17.3B quarter and 14% security growth still carry the stock.

## Sources

1. [The Register, "Cisco make-me-root email bug exploited as a 0-day by unknown crims", 14 October 2026](https://www.theregister.com/security/2026/10/14/cisco-make-me-root-email-bug-exploited-as-a-0-day-by-unknown-crims/5303168)
2. [Seeking Alpha, "Cisco Systems leads in Morgan Stanley's CIO survey despite spending moderation", 15 October 2026](https://seekingalpha.com/news/4653540-cisco-systems-leads-in-morgan-stanleys-cio-survey-despite-spending-moderation)
3. [Cisco PSIRT advisory cisco-sa-esa-afw-zqYJkjxp, "Cisco Secure Email Gateway Arbitrary File Write Vulnerability", 14 October 2026](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp)
4. [CISA, Known Exploited Vulnerabilities Catalog, entry for CVE-2026-76519, added 14 October 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
5. [SecurityWeek, "Cisco Warns of Exploited Secure Email Gateway Vulnerability", 15 October 2026](https://www.securityweek.com/cisco-warns-of-exploited-secure-email-gateway-vulnerability/)
6. [BleepingComputer, "Cisco patches new Secure Email Gateway zero-day exploited in attacks", 14 October 2026](https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/)
7. [Help Net Security, "Cisco patches actively exploited email gateway zero-day (CVE-2026-76461)", 15 September 2026](https://www.helpnetsecurity.com/2026/09/15/cve-2026-76461-cisco-email-gateway-zero-day-exploited/)
8. [Cisco Q4 and fiscal year 2026 earnings call transcript, via Yahoo Finance, 12 August 2026](https://finance.yahoo.com/quote/4333.HK/earnings/4333.HK-Q4-2026-earnings_call-668273.html)
9. [Cisco, quarterly revenue from its SEC filings, retrieved 16 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0000858877)


---

One email takes over Cisco's email gateway a third time as buy intent for its security falls to 47% from 57% — The Inference. Canonical: https://theinference.org/article/one-email-takes-over-cisco-s-email-gateway-a-third-time-as-buy-intent-for-its-security-falls-to-47-from-57