Separate the ISE and ISE-PIC bulletin scopes

Bottom line: Build a separate product-and-release decision for each listed vulnerability. Do not let one ISE-PIC inventory entry stand in for the advisory’s different product scopes.

Source fact: documented behavior

The Cisco Identity Services Engine Authentication Bypass Vulnerabilities scopes CVE-2026-76439 to Cisco ISE at publication, regardless of device configuration.

For CVE-2026-76444, CVE-2026-76446 and CVE-2026-76447, the advisory includes both ISE and ISE-PIC, also regardless of configuration at publication.

Cisco says the vulnerabilities are independent and that a software release affected by one may not be affected by another; the advisory provides software updates and no workarounds.

What the source does not establish

This article organizes the advisory assessment. It does not establish that a particular installation is vulnerable, compromised or fixed. Keep the actual product identity, installed release and current vendor release information with every conclusion; do not derive local exposure from a vulnerability title or score alone.

Applicability questions

• Is the installed product ISE, ISE-PIC or a separately identified component?
• Which of the four CVEs is each finding about?
• What actual release and vendor fixed-release evidence support that row?
• Who owns an unresolved product or version identification?

DSE recommendation: controlled next steps

The following steps are DSE recommendations based on the cited source.

DSE recommends a four-row advisory assessment that preserves the product boundary and an independent disposition for each vulnerability.

1. Retrieve the actual product identity and software release from the approved inventory or supported administration view. Retain that evidence without copying secret configuration. Create one row per advisory CVE and identify the product scope stated for that row. Keep an ISE-PIC asset out of the ISE-only row unless later controlling vendor guidance changes that scope.
2. Compare each relevant row with the current release information linked by Cisco. Record the advisory revision and the exact evidence used rather than marking the whole asset fixed after reviewing only one vulnerability. If a scanner combines several CVEs under one finding, preserve a separate internal mapping so a reviewer can tell which release decision has actually been checked.
3. Have the service owner review the required upgrade route and operational validation for the actual deployment. Preserve unresolved rows with an owner and a next action. Keep any incident investigation separate from the release assessment; an applicable advisory is a reason to assess the installation, not a substitute for evidence that exploitation occurred.

Verification and evidence

Proposed verification: use a desk fixture containing one ISE record and one ISE-PIC record. Ask a second reviewer to map all four CVEs using the source product statements before examining any patch status. Then supply the permitted release evidence and require a separate conclusion for each applicable row.

For an authorized upgrade, retrieve the resulting software identity and reconcile it with the approved target and each open row. Record any remaining uncertainty without automatically closing related findings. No Cisco deployment was inspected or upgraded for this article; the proposed matrix exercise does not establish exploitation, complete remediation or suitability of an unnamed release.

Official references

• Cisco Identity Services Engine Authentication Bypass Vulnerabilities — Cisco; official security advisory.

Source review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings.