{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/separate-the-ise-and-ise-pic-bulletin-scopes/", "item": { "id": "https://update.dsesecurity.com/updates/separate-the-ise-and-ise-pic-bulletin-scopes/", "slug": "separate-the-ise-and-ise-pic-bulletin-scopes", "url": "https://update.dsesecurity.com/updates/separate-the-ise-and-ise-pic-bulletin-scopes/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/separate-the-ise-and-ise-pic-bulletin-scopes.md", "json": "https://update.dsesecurity.com/api/v1/posts/separate-the-ise-and-ise-pic-bulletin-scopes/" }, "title": "Separate the ISE and ISE-PIC bulletin scopes", "summary": "Track the ISE bulletin’s four CVEs separately. Preserve its ISE-only versus ISE-and-ISE-PIC product boundary instead of assigning one family-wide finding to every deployment.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "advisory", "name": "Advisory" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-30T06:05:01+00:00", "modified_at": "2026-10-30T06:05:13+00:00", "reviewed_on": "2026-10-30", "reading_minutes": 3, "word_count": 527, "potentially_affected": "Cisco ISE and ISE-PIC deployments being assessed against the cited authentication-bypass advisory; exact release applicability must be checked separately for each listed vulnerability.", "dse_recommendation": "DSE recommends a four-row advisory assessment that preserves the product boundary and an independent disposition for each vulnerability.", "primary_source": { "name": "Cisco — Cisco Identity Services Engine Authentication Bypass Vulnerabilities", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiauth-bypass-sgD2HbL4", "published_on": null, "authority": "sec.cloudapps.cisco.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Bottom line: Build a separate product-and-release decision for each listed vulnerability. Do not let one ISE-PIC inventory entry stand in for the advisory’s different product scopes.

\n

Source fact: documented behavior

\n

The Cisco Identity Services Engine Authentication Bypass Vulnerabilities scopes CVE-2026-76439 to Cisco ISE at publication, regardless of device configuration.

\n

For CVE-2026-76444, CVE-2026-76446 and CVE-2026-76447, the advisory includes both ISE and ISE-PIC, also regardless of configuration at publication.

\n

Cisco says the vulnerabilities are independent and that a software release affected by one may not be affected by another; the advisory provides software updates and no workarounds.

\n

What the source does not establish

\n

This article organizes the advisory assessment. It does not establish that a particular installation is vulnerable, compromised or fixed. Keep the actual product identity, installed release and current vendor release information with every conclusion; do not derive local exposure from a vulnerability title or score alone.

\n

Applicability questions

\n\n

DSE recommendation: controlled next steps

\n

The following steps are DSE recommendations based on the cited source.

\n

DSE recommends a four-row advisory assessment that preserves the product boundary and an independent disposition for each vulnerability.

\n
    \n
  1. Retrieve the actual product identity and software release from the approved inventory or supported administration view. Retain that evidence without copying secret configuration. Create one row per advisory CVE and identify the product scope stated for that row. Keep an ISE-PIC asset out of the ISE-only row unless later controlling vendor guidance changes that scope.
    2. \n
  2. Compare each relevant row with the current release information linked by Cisco. Record the advisory revision and the exact evidence used rather than marking the whole asset fixed after reviewing only one vulnerability. If a scanner combines several CVEs under one finding, preserve a separate internal mapping so a reviewer can tell which release decision has actually been checked.
    3. \n
  3. Have the service owner review the required upgrade route and operational validation for the actual deployment. Preserve unresolved rows with an owner and a next action. Keep any incident investigation separate from the release assessment; an applicable advisory is a reason to assess the installation, not a substitute for evidence that exploitation occurred.
    4. \n
\n

Verification and evidence

\n

Proposed verification: use a desk fixture containing one ISE record and one ISE-PIC record. Ask a second reviewer to map all four CVEs using the source product statements before examining any patch status. Then supply the permitted release evidence and require a separate conclusion for each applicable row.

\n

For an authorized upgrade, retrieve the resulting software identity and reconcile it with the approved target and each open row. Record any remaining uncertainty without automatically closing related findings. No Cisco deployment was inspected or upgraded for this article; the proposed matrix exercise does not establish exploitation, complete remediation or suitability of an unnamed release.

\n

Official references

\n\n

Source review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.

\n", "content_text": "Bottom line: Build a separate product-and-release decision for each listed vulnerability. Do not let one ISE-PIC inventory entry stand in for the advisory’s different product scopes.\nSource fact: documented behavior\nThe Cisco Identity Services Engine Authentication Bypass Vulnerabilities scopes CVE-2026-76439 to Cisco ISE at publication, regardless of device configuration.\nFor CVE-2026-76444, CVE-2026-76446 and CVE-2026-76447, the advisory includes both ISE and ISE-PIC, also regardless of configuration at publication.\nCisco says the vulnerabilities are independent and that a software release affected by one may not be affected by another; the advisory provides software updates and no workarounds.\nWhat the source does not establish\nThis article organizes the advisory assessment. It does not establish that a particular installation is vulnerable, compromised or fixed. Keep the actual product identity, installed release and current vendor release information with every conclusion; do not derive local exposure from a vulnerability title or score alone.\nApplicability questions\n\nIs the installed product ISE, ISE-PIC or a separately identified component?\nWhich of the four CVEs is each finding about?\nWhat actual release and vendor fixed-release evidence support that row?\nWho owns an unresolved product or version identification?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends a four-row advisory assessment that preserves the product boundary and an independent disposition for each vulnerability.\n\nRetrieve the actual product identity and software release from the approved inventory or supported administration view. Retain that evidence without copying secret configuration. Create one row per advisory CVE and identify the product scope stated for that row. Keep an ISE-PIC asset out of the ISE-only row unless later controlling vendor guidance changes that scope.\nCompare each relevant row with the current release information linked by Cisco. Record the advisory revision and the exact evidence used rather than marking the whole asset fixed after reviewing only one vulnerability. If a scanner combines several CVEs under one finding, preserve a separate internal mapping so a reviewer can tell which release decision has actually been checked.\nHave the service owner review the required upgrade route and operational validation for the actual deployment. Preserve unresolved rows with an owner and a next action. Keep any incident investigation separate from the release assessment; an applicable advisory is a reason to assess the installation, not a substitute for evidence that exploitation occurred.\n\nVerification and evidence\nProposed verification: use a desk fixture containing one ISE record and one ISE-PIC record. Ask a second reviewer to map all four CVEs using the source product statements before examining any patch status. Then supply the permitted release evidence and require a separate conclusion for each applicable row.\nFor an authorized upgrade, retrieve the resulting software identity and reconcile it with the approved target and each open row. Record any remaining uncertainty without automatically closing related findings. No Cisco deployment was inspected or upgraded for this article; the proposed matrix exercise does not establish exploitation, complete remediation or suitability of an unnamed release.\nOfficial references\n\nCisco Identity Services Engine Authentication Bypass Vulnerabilities — Cisco; official security advisory.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.", "content_markdown": "Bottom line: Build a separate product-and-release decision for each listed vulnerability. Do not let one ISE-PIC inventory entry stand in for the advisory’s different product scopes.\n\n## Source fact: documented behavior\n\nThe [Cisco Identity Services Engine Authentication Bypass Vulnerabilities](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiauth-bypass-sgD2HbL4) scopes CVE-2026-76439 to Cisco ISE at publication, regardless of device configuration.\n\nFor CVE-2026-76444, CVE-2026-76446 and CVE-2026-76447, the advisory includes both ISE and ISE-PIC, also regardless of configuration at publication.\n\nCisco says the vulnerabilities are independent and that a software release affected by one may not be affected by another; the advisory provides software updates and no workarounds.\n\n## What the source does not establish\n\nThis article organizes the advisory assessment. It does not establish that a particular installation is vulnerable, compromised or fixed. Keep the actual product identity, installed release and current vendor release information with every conclusion; do not derive local exposure from a vulnerability title or score alone.\n\n## Applicability questions\n\n- Is the installed product ISE, ISE-PIC or a separately identified component?\n\n- Which of the four CVEs is each finding about?\n\n- What actual release and vendor fixed-release evidence support that row?\n\n- Who owns an unresolved product or version identification?\n\n## DSE recommendation: controlled next steps\n\nThe following steps are DSE recommendations based on the cited source.\n\nDSE recommends a four-row advisory assessment that preserves the product boundary and an independent disposition for each vulnerability.\n\n- Retrieve the actual product identity and software release from the approved inventory or supported administration view. Retain that evidence without copying secret configuration. Create one row per advisory CVE and identify the product scope stated for that row. Keep an ISE-PIC asset out of the ISE-only row unless later controlling vendor guidance changes that scope.\n\n- Compare each relevant row with the current release information linked by Cisco. Record the advisory revision and the exact evidence used rather than marking the whole asset fixed after reviewing only one vulnerability. If a scanner combines several CVEs under one finding, preserve a separate internal mapping so a reviewer can tell which release decision has actually been checked.\n\n- Have the service owner review the required upgrade route and operational validation for the actual deployment. Preserve unresolved rows with an owner and a next action. Keep any incident investigation separate from the release assessment; an applicable advisory is a reason to assess the installation, not a substitute for evidence that exploitation occurred.\n\n## Verification and evidence\n\nProposed verification: use a desk fixture containing one ISE record and one ISE-PIC record. Ask a second reviewer to map all four CVEs using the source product statements before examining any patch status. Then supply the permitted release evidence and require a separate conclusion for each applicable row.\n\nFor an authorized upgrade, retrieve the resulting software identity and reconcile it with the approved target and each open row. Record any remaining uncertainty without automatically closing related findings. No Cisco deployment was inspected or upgraded for this article; the proposed matrix exercise does not establish exploitation, complete remediation or suitability of an unnamed release.\n\n## Official references\n\n- [Cisco Identity Services Engine Authentication Bypass Vulnerabilities](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiauth-bypass-sgD2HbL4) — Cisco; official security advisory.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/separate-the-ise-and-ise-pic-bulletin-scopes/", "url": "https://update.dsesecurity.com/updates/separate-the-ise-and-ise-pic-bulletin-scopes/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-30" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/separate-the-ise-and-ise-pic-bulletin-scopes/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Separate the ISE and ISE-PIC bulletin scopes", "item": "https://update.dsesecurity.com/updates/separate-the-ise-and-ise-pic-bulletin-scopes/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/separate-the-ise-and-ise-pic-bulletin-scopes/#article", "identifier": "https://update.dsesecurity.com/updates/separate-the-ise-and-ise-pic-bulletin-scopes/", "url": "https://update.dsesecurity.com/updates/separate-the-ise-and-ise-pic-bulletin-scopes/", "headline": "Separate the ISE and ISE-PIC bulletin scopes", "description": "Track the ISE bulletin’s four CVEs separately. Preserve its ISE-only versus ISE-and-ISE-PIC product boundary instead of assigning one family-wide finding…", "abstract": "Track the ISE bulletin’s four CVEs separately. Preserve its ISE-only versus ISE-and-ISE-PIC product boundary instead of assigning one family-wide finding to every deployment.", "articleBody": "Bottom line: Build a separate product-and-release decision for each listed vulnerability. Do not let one ISE-PIC inventory entry stand in for the advisory’s different product scopes.\nSource fact: documented behavior\nThe Cisco Identity Services Engine Authentication Bypass Vulnerabilities scopes CVE-2026-76439 to Cisco ISE at publication, regardless of device configuration.\nFor CVE-2026-76444, CVE-2026-76446 and CVE-2026-76447, the advisory includes both ISE and ISE-PIC, also regardless of configuration at publication.\nCisco says the vulnerabilities are independent and that a software release affected by one may not be affected by another; the advisory provides software updates and no workarounds.\nWhat the source does not establish\nThis article organizes the advisory assessment. It does not establish that a particular installation is vulnerable, compromised or fixed. Keep the actual product identity, installed release and current vendor release information with every conclusion; do not derive local exposure from a vulnerability title or score alone.\nApplicability questions\n\nIs the installed product ISE, ISE-PIC or a separately identified component?\nWhich of the four CVEs is each finding about?\nWhat actual release and vendor fixed-release evidence support that row?\nWho owns an unresolved product or version identification?\n\nDSE recommendation: controlled next steps\nThe following steps are DSE recommendations based on the cited source.\nDSE recommends a four-row advisory assessment that preserves the product boundary and an independent disposition for each vulnerability.\n\nRetrieve the actual product identity and software release from the approved inventory or supported administration view. Retain that evidence without copying secret configuration. Create one row per advisory CVE and identify the product scope stated for that row. Keep an ISE-PIC asset out of the ISE-only row unless later controlling vendor guidance changes that scope.\nCompare each relevant row with the current release information linked by Cisco. Record the advisory revision and the exact evidence used rather than marking the whole asset fixed after reviewing only one vulnerability. If a scanner combines several CVEs under one finding, preserve a separate internal mapping so a reviewer can tell which release decision has actually been checked.\nHave the service owner review the required upgrade route and operational validation for the actual deployment. Preserve unresolved rows with an owner and a next action. Keep any incident investigation separate from the release assessment; an applicable advisory is a reason to assess the installation, not a substitute for evidence that exploitation occurred.\n\nVerification and evidence\nProposed verification: use a desk fixture containing one ISE record and one ISE-PIC record. Ask a second reviewer to map all four CVEs using the source product statements before examining any patch status. Then supply the permitted release evidence and require a separate conclusion for each applicable row.\nFor an authorized upgrade, retrieve the resulting software identity and reconcile it with the approved target and each open row. Record any remaining uncertainty without automatically closing related findings. No Cisco deployment was inspected or upgraded for this article; the proposed matrix exercise does not establish exploitation, complete remediation or suitability of an unnamed release.\nOfficial references\n\nCisco Identity Services Engine Authentication Bypass Vulnerabilities — Cisco; official security advisory.\n\nSource review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.", "datePublished": "2026-10-30T06:05:01+00:00", "dateModified": "2026-10-30T06:05:13+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/separate-the-ise-and-ise-pic-bulletin-scopes/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/separate-the-ise-and-ise-pic-bulletin-scopes/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate the ISE and ISE-PIC bulletin scopes" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 527, "timeRequired": "PT3M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Cisco — Cisco Identity Services Engine Authentication Bypass Vulnerabilities", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multiauth-bypass-sgD2HbL4" } } ] } }