6 days ago

April 13, 2026

Summary

Use reputation scores in the Censys Platform to quickly determine the potential risk associated with hosts, validated by transparent evidence in the Censys dataset.
One new Censys ARC Rapid Response advisory for improper access control vulnerability in Fortinet FortiClient EMS [CVE-2026-35616].
Added new fingerprints for handlebars.js and several SIP and VoIP services.
Added two new ASM risk fingerprints for vulnerable Handlebars.js [CVE-2026-33937] and vulnerable FortiClient EMS [CVE-2026-35616].

Platform

Use reputation scores in the Censys Platform to quickly determine the potential risk associated with hosts, validated by transparent evidence in the Censys dataset. This score enables you to prioritize alerts with IP indicators faster and perform triage and analysis more effectively with a transparent and consistent scoring methodology.
- Reputation scores and their attendant data are only available to Censys Enterprise users. Additional score context data is available to Censys Enterprise users with access to the Adversary Investigation module. See the documentation for more information.

Censys ARC Rapid Response

The Censys ARC team published information about and queries for the following issue.

April 7 Advisory: Improper Access Control Vulnerability in Fortinet FortiClient EMS [CVE-2026-35616]
- The following queries can be used to identify exposed instances. Not all of these services are necessarily vulnerable.

New fingerprints and risks

Added the following fingerprints and risks.

Note that new ASM risk fingerprints may be disabled by default in your workspace. Reference your risk type configuration in the ASM web console to review new risk types.

New fingerprints

Name	Description	Query
handlebars.js	This asset embeds the Handlebars.js JavaScript templating library.	Platform query
Cisco Expressway	Cisco Expressway is a collaboration gateway that provides firewall-traversal technology for voice, video, content, and instant messaging.	Platform query
Sangoma Asterisk	Sangoma Asterisk is an open-source communications framework for building Voice over Internet Protocol Private Branch Exchange (VoIP PBX) systems, voicemail, and conferencing.	Platform query
Sangoma Certified Asterisk	Sangoma Certified Asterisk is a specialized version of Asterisk designed for enterprise environments requiring high reliability and support.	Platform query
Sangoma FreePBX	FreePBX is a web-based open-source GUI for controlling and managing Asterisk.	Platform query
STARFACE	STARFACE is a Session Initiation Protocol (SIP) trunking service and IP-based telephony solution.	Platform query
Wildix Media Gateway	Wildix Media Gateway is a device that bridges traditional telephony lines (analog, PRI, BRI, GSM/LTE) with the Wildix VoIP PBX system.	Platform query

New ASM risks

Name	Description	Query
Vulnerable Handlebars.js [CVE-2026-33937]	This service is using a version of Handlebars.js (4.0.0–4.7.8) vulnerable to CVE-2026-33937, a critical server-side remote code execution vulnerability. Handlebars.compile() emits the value field of a NumberLiteral AST node directly into generated JavaScript without sanitization. An attacker who controls the AST passed to compile() can inject and execute arbitrary JavaScript in any Node.js application that passes user-controlled input to compile().	ASM risk query: `risks.name: "Vulnerable Handlebars.js [CVE-2026-33937]"`
Vulnerable FortiClient EMS [CVE-2026-35616]	This is an exposed FortiClient EMS instance prone to an improper access control vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.	ASM risk query: `risks.name: "Vulnerable FortiClient EMS [CVE-2026-35616]"`

Name

Description

Query

Vulnerable Handlebars.js [CVE-2026-33937]

This service is using a version of Handlebars.js (4.0.0–4.7.8) vulnerable to CVE-2026-33937, a critical server-side remote code execution vulnerability. Handlebars.compile() emits the value field of a NumberLiteral AST node directly into generated JavaScript without sanitization. An attacker who controls the AST passed to compile() can inject and execute arbitrary JavaScript in any Node.js application that passes user-controlled input to compile().

ASM risk query:

risks.name: "Vulnerable Handlebars.js [CVE-2026-33937]"

Vulnerable FortiClient EMS [CVE-2026-35616]

This is an exposed FortiClient EMS instance prone to an improper access control vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

ASM risk query:

risks.name: "Vulnerable FortiClient EMS [CVE-2026-35616]"

13 days ago

April 6, 2026

Summary

Added 19 new fingerprints for SSL VPNs, operating systems, and several other products and services.

New fingerprints

Added the following fingerprints.

Name	Description	Query
ALEOS	This is an ALEOS operating system for Sierra Wireless devices.	Platform query
Stormshield SSL VPN	This is a Stormshield SSL VPN server.	Platform query
SonicWall Virtual Office	This is a SonicWall Virtual Office SSL VPN server.	Platform query
SonicWALL Pro	This is a SonicWALL Pro series firewall (covers Pro 100, Pro 200, and so on).	Platform query
SonicWALL NSSP	This is a SonicWALL NSSP (Network Security Services Platform) device.	Platform query
Leadsec SSL VPN	This is a Leadsec SSL VPN server.	Platform query
KobzVPN	This is a KobzVPN server.	Platform query
Juniper NSM	This is a Juniper NSM (Network and Security Manager) server, covering NSM3000 and NSM Express.	Platform query
Huawei SSL VPN	This is a Huawei SSL VPN server.	Platform query
DPtech SSL VPN	This is a DPtech SSL VPN server.	Platform query
Citrix SD-WAN	This is a Citrix SD-WAN server.	Platform query
Citrix Access Gateway	This is a Citrix Access Gateway server.	Platform query
Cisco StarOS	This is a Cisco StarOS utility server.	Platform query
Cisco IOS XR	This is a Cisco IOS XR operating system, commonly found on routers.	Platform query
Cisco Cloud Services Router 1000v	This is a Cisco Cloud Services Router 1000v.	Platform query
Cisco AnyConnect Secure Mobility Client	This is a Cisco AnyConnect Secure Mobility Client (SSL VPN) server.	Platform query
Check Point SSL Network Extender	This is a Check Point SSL Network Extender server.	Platform query
Check Point Harmony SASE	This is a Check Point Harmony SASE server.	Platform query
Barracuda SSL VPN	This is a Barracuda SSL VPN server.	Platform query

20 days ago

March 30, 2026

Summary

Use new Platform Threat Hunting CensEye APIs to create pivot analysis jobs to find web infrastructure related to threats and other assets.
Run queries for new security advisories published the Censys ARC team directly from the Platform home page.
You can now view interactive demos of data add-on modules in the Platform web console.
One new Rapid Response advisory for Citrix NetScaler ADC and Gateway out-of-bounds read vulnerability [CVE-2026-3055].

Platform

Run queries for trending security advisories published the Censys ARC team directly from the Platform home page.
- ARC, Censys' cybersecurity research team, frequently releases new advisories and queries for trending security issues. These are shown in a carousel under the search bar. Use these queries to track important issues and learn how to build your own targeted searches. Most of these queries utilize data that is available to Free users, but sometimes they will use regex or other entitled fields.
You can now view interactive demos of data add-on modules in the Platform web console. Use the left navigation bar to view demos for the Adversary Investigation and Critical Infrastructure modules.

Adversary Investigation

Use new CensEye APIs to create pivot analysis jobs to find web infrastructure related to threats and other assets.
- The new pivot analysis job endpoint extracts default pivot fields from the target asset and counts matching documents for each field-value pair. This is similar to using CensEye in the Platform web UI.
- The other two new endpoints can be used to check job status and retrieve job results.

Rapid Response

The Censys ARC team published information about and queries for the following issue.

March 26 Advisory: Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability [CVE-2026-3055]
- The following queries can be used to identify exposed instances. Not all of these services are necessarily vulnerable.

27 days ago

March 23, 2026

Summary

Use the new Censys for Splunk SOAR and Censys for Splunk Platform integrations to enhance your SOC workflows with Censys data enrichment and playbook actions.
Two new Censys ARC Rapid Response advisories for pre-authentication RCE vulnerability in GNU Inetutils Telnetd [CVE-2026-32746] and Ubiquiti UniFi network application remote path traversal vulnerability [CVE-2026-22557].
The name of the "Explore Threats" page in the Platform UI has been changed to "Tracked Threats."
Added one new fingerprint for NetBox and two new ASM risks.

Platform

Use the new Censys for Splunk SOAR and Censys for Splunk Platform integrations to enhance your SOC workflows with Censys data enrichment and playbook actions.
- These integrations include several ad hoc enrichment actions for hosts, web properties, and certificates that can be used on an ad hoc basis or used for automated enrichment.
- Watch this video to learn more about how to use the Splunk SOAR application.
The name of the "Explore Threats" page in the Platform UI has been changed to "Tracked Threats."

Rapid Response

The Censys Rapid Response team published information about and queries for the following issue.

March 18 Advisory: Pre-Authentication RCE Vulnerability in GNU Inetutils Telnetd [CVE-2026-32746]
- The following queries can be used to identify exposed instances. Not all of these services are necessarily vulnerable.
March 19 Advisory: Ubiquiti UniFi Network Application Remote Path Traversal Vulnerability [CVE-2026-22557]
- The following queries can be used to identify exposed instances. Not all of these services are necessarily vulnerable.

New fingerprints

Added the following fingerprints.

Note that new ASM risk fingerprints may be disabled by default in your workspace. Reference your risk type configuration in the ASM web console to review new risk types.

Type	Name	Description	Query
hardware	NetBox	NetBox is an open-source DCIM and IPAM tool for managing network infrastructure.	Platform query
risk	Exposed FortiAnalyzer Application	An HTTP service is exposing a Fortinet FortiAnalyzer application. FortiAnalyzer is a centralized logging and reporting solution that aggregates security and traffic data from FortiGate and other Fortinet devices. Exposing this management interface to the internet can allow unauthorized access to sensitive network and security analytics.	ASM risk query: `risks.name: "Exposed FortiAnalyzer Application"`
risk	Exposed NetBox Application	A NetBox application is exposed to the internet. NetBox is a DCIM and IPAM tool that manages network infrastructure, IP allocations, and device inventories. Exposure may allow unauthorized access to sensitive network topology and infrastructure data.	ASM risk query: `risks.name: "Exposed NetBox Application"`

Type

Name

Description

Query

hardware

NetBox

NetBox is an open-source DCIM and IPAM tool for managing network infrastructure.

Platform query

risk

Exposed FortiAnalyzer Application

An HTTP service is exposing a Fortinet FortiAnalyzer application. FortiAnalyzer is a centralized logging and reporting solution that aggregates security and traffic data from FortiGate and other Fortinet devices. Exposing this management interface to the internet can allow unauthorized access to sensitive network and security analytics.

ASM risk query:

risks.name: "Exposed FortiAnalyzer Application"

risk

Exposed NetBox Application

A NetBox application is exposed to the internet. NetBox is a DCIM and IPAM tool that manages network infrastructure, IP allocations, and device inventories. Exposure may allow unauthorized access to sensitive network topology and infrastructure data.

ASM risk query:

risks.name: "Exposed NetBox Application"

about 1 month ago

March 16, 2026

Summary

Added new fingerprints for several remote monitoring and management (RMM) tools and Datto SIRIS.
Added new protocol and application scanners for Anerma CF Forth, ICAP, and STUN.

New fingerprints

Added the following fingerprints.

Type	Name	Description	Query
software	Datto RMM	Datto RMM is a cloud-based tool used for remote monitoring and management (RMM).	Platform query
software	Datto SIRIS	Datto SIRIS is a business continuity and disaster recovery (BCDR) tool designed for MSPs.	Platform query
software	Atera	Atera is an RMM tool.	Platform query
software	SimpleHelp	SimpleHelp is an RMM tool.	Platform query
software	Splashtop	Splashtop is an RMM tool.	Platform query
software	Zoho Assist	Zoho Assist is an RMM tool.	Platform query

New protocols and application scanners

Added support for the following protocols and applications.

Protocol/application	Query	Data availability
`ANERMA_CF_FORTH`	Platform query	Data is only visible and searchable to users with access to the Critical Infrastructure module.
`ICAP`	Platform query	Data is visible to and searchable by Starter, Core, and Enterprise users.
`STUN`	Platform query	Data is visible to Starter users and is visible to and searchable by Core and Enterprise users.

about 1 month ago

March 9, 2026

Summary

Platform users with access to the Critical Infrastructure module can use the new Critical Infrastructure dashboard to quickly pivot through a filterable view of ICS/OT assets and data identified by Censys scans.
Add Censys Platform data enrichment to your security workflows using new integrations with OpenCTI and CyWare.
Gain a better picture into host history using the new get service history for a host Platform API endpoint .
Use new extracted_text data in the Platform to find assets with screenshots that include keywords like vendor or product names, login interfaces, and more.
Added several new Platform fingerprints and ASM risk fingerprints, including Cisco Catalyst SD-WAN Manager, Gogs, Gitea, Raspberry Shake, numerous Nagios services, and more.

Platform

Users with access to the Critical Infrastructure module can use the new Critical Infrastructure dashboard to quickly pivot through a filterable view of ICS/OT assets and data identified by Censys scans.
- Use the dashboard to find assets of interest based on location, vendor, product name, protocol, text extracted from screenshots, and more. Learn more in the documentation.
Use new integrations to add Censys data enrichment to hosts, domains, certificates, and more to OpenCTI and CyWare.
- These integrations were developed and are maintained by OpenCTI and CyWare, respectively.
Leverage the new get service history for a host API endpoint to retrieve time ranges during which services were detected on the host.
- This is similar to the host services timeline in the Platform web UI.
Use new extracted_text data on services and endpoints to find assets with screenshots that include keywords like vendor or product names, login interfaces, and more. This data can be found in the following new fields:
- host.services.screenshots.extracted_text
- host.services.endpoints.screenshots.extracted_text
- web.endpoints.screenshots.extracted_text
- extracted_text data is only available to users on the Core or Enterprise plans.

New fingerprints

Added the following fingerprints.

Note that new ASM risk fingerprints may be disabled by default in your workspace. Reference your risk type configuration in the ASM web console to review new risk types.

Type	Name	Description	Query
risk	Exposed Fast Reverse Proxy (FRP) Server	An exposed Fast Reverse Proxy (FRP) server dashboard has been detected. FRP is an open-source reverse proxy tool that allows users to expose internal services through NAT or firewalls to the internet without authorization. When deployed without IT approval, FRP constitutes shadow IT and creates significant security risks: it bypasses firewall controls, exposes internal services without proper security review, and has been observed being used by threat actors as a command-and-control tunneling mechanism.	ASM query: risks.name: `Exposed Fast Reverse Proxy (FRP) Server`
risk	Exposed Gogs Application	This is an exposed HTTP service running Gogs. This self-hosted Git service often contains source code repositories, user credentials, and CI/CD configurations. The sensitive nature of the information contained in this application makes it a target.	ASM query: risks.name: `Exposed Gogs Application`
risk	Exposed Gitea Application	This is an exposed HTTP service running Gitea. This self-hosted Git service often contains source code repositories, user credentials, and CI/CD configurations. The sensitive nature of the information contained in this application makes it a target.	ASM query: risks.name: `Exposed Gitea Application`
risk	Exposed Nagios Fusion Application	A Nagios Fusion application is exposed to the internet. Nagios Fusion is a multi-server management platform that provides a unified view of monitoring servers. Exposure may allow unauthorized access to centralized monitoring management.	ASM query: risks.name: `Exposed Nagios Fusion Application`
risk	Exposed Nagios Log Server Application	A Nagios Log Server application is exposed to the internet. Nagios Log Server is a centralized log management platform that can contain sensitive operational data. Exposure may allow unauthorized access to log data.	ASM query: risks.name: `Exposed Nagios Log Server Application`
risk	Exposed Nagios Network Analyzer Application	A Nagios Network Analyzer application is exposed to the internet. Nagios Network Analyzer is a netflow and bandwidth monitoring tool that provides network traffic visibility. Exposure may allow unauthorized access to network analytics.	ASM query: risks.name: `Exposed Nagios Network Analyzer Application`
risk	Exposed Nagios Core Application	A Nagios Core application is exposed to the internet. Nagios Core is an open-source monitoring platform that provides infrastructure monitoring and alerting. Exposure may allow unauthorized access to monitoring data.	ASM query: risks.name: `Exposed Nagios Core Application`
risk	Exposed Nagios Cross Platform Agent Application	A Nagios Cross Platform Agent (NCPA) application is exposed to the internet. Nagios Cross Platform Agent (NCPA) is a cross-platform monitoring agent that provides system metrics and remote management capabilities. Exposure may allow unauthorized access to system metrics and agent management.	ASM query: risks.name: `Exposed Nagios Cross Platform Agent Application`
risk	Exposed Nagios XI Application	A Nagios XI application is exposed to the internet. Nagios XI is an enterprise monitoring platform that provides infrastructure visibility and alerting. Exposure may allow unauthorized access to monitoring data and system management.	ASM query: risks.name: `Exposed Nagios XI Application`
software	N-able Take Control	N-able Take Control is a remote support solution that can give users access to Windows, Mac, Linux, and mobile devices.	Platform query
software	GrowthBook	GrowthBook is the an open-source platform for feature flagging and experimentation.	Platform query
hardware	Coslat Firewall	This is a Coslat Firewall instance.	Platform query
software	Blackboard Transact Suite	Blackboard Transact Suite is a cloud-based campus management solution used in higher education for integrated payments, security, and commerce.	Platform query
software	Zoho Meeting	Zoho Meeting is an online meeting platform.	Platform query
software	RAGFlow	RAGflow is an open-source Retrieval-Augmented Generation (RAG) engine.	Platform query
software	Cisco Catalyst SD-WAN Manager	This is a Cisco Catalyst SD-WAN Manager server.	Platform query
software	Nagios Log Server	This is a Nagios Log Server for centralized log management.	Platform query
software	Nagios NCPA	This is a Nagios Cross-Platform Agent (NCPA) web interface.	Platform query
software	Nagios Fusion	This is a Nagios Fusion monitoring dashboard.	Platform query
software	Nagios Network Analyzer	This is a Nagios Network Analyzer for netflow analysis and bandwidth monitoring.	Platform query
software	Raspberry Shake	Raspberry Shake is a low-cost, professional-grade personal seismograph that pairs with a Raspberry Pi computer to detect ground vibrations, including earthquakes, volcanic activity, and human-made noise.	Platform query
software	Remotely Admin Console	Remotely is an open-source, self-hosted remote control and management solution built with .NET 8, Blazor, and SignalR, designed as a TeamViewer alternative.	Platform query
software	Neo4j Graph Database	Neo4j is a graph database management system detected via HTTP API JSON response.	Platform query

about 2 months ago

March 2, 2026

Summary

The Censys Platform web UI has been updated to make the search bar the focus on the home page and improve navigation. See below for more details.
Use the new Search History page in the Platform web UI to review your search activity over the past seven days.
Added a protocol scanner for Gemini, an application-layer internet communication protocol for accessing remote documents.
New fingerprints for TiVo DVRs, Gitea instances, Gogs instances, and a new ASM risk for exposed Ollama applications.
One new Rapid Response advisory for Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass [CVE-2026-20127].

Platform UI updates

The Censys Platform web UI has been updated to make the search bar the focus on the home page and improve navigation.

Left-side navigation panel

The organization you are currently logged into is displayed in the top of the left-side nav bar. Switch to your Free account or another organization and access your organizational and personal settings from the organization drop-down.
- Open the account selector menu, select your account or organization, and click the credits section to go to the Credit Management page.
Access to search and the dashboards for the Threat Hunting and Critical Infrastructure modules is now located in the Intelligence section of the left-side nav bar.
The My Work section contains your collections, a link to the Investigation Manager, and your search history.
The Resources section includes links to the Release Notes feed, the Censys Community. Additional resources like the Censys Academy and Data Definitions are nested under Learn in this section.

Alerts and Notifications

Access webhook configuration by clicking the bell icon for Alerts and Notifications in the top-right corner.

Personal Access Tokens, account management, and more

Create and manage Personal Access Tokens (PATs), manage your account, and switch between light and dark mode using the profile menu in the top right corner.

Platform Search History page

The new Search History page in the Platform web console records all of the searches you ran in the Platform UI over the previous 7 days.

New protocols and application scanners

Added support for the following protocol.

Protocol/application	Query	Data availability
`GEMINI`	Platform query	Visible and searchable to all user tiers.

New fingerprints

Added the following fingerprints.

Note that new ASM risk fingerprints may be disabled by default in your workspace. Reference your risk type configuration in the ASM web console to review new risk types.

Type	Name	Description	Query
risk	Exposed Ollama Application	An exposed Ollama server. This application allows users to run and manage large language models (LLMs) locally. Exposing this service to the public internet can allow unauthorized access to AI models and computational resources.	ASM query: `risks.name: "Exposed Ollama Application"`
hardware	TiVo DVR	This is a TiVo digital video recorder (DVR).	Platform query
software	Gitea	Gitea is a self-hosted Git service.	Platform query
software	Gogs	Gogs is a self-hosted Git service.	Platform query

Rapid Response

The Censys Rapid Response team published information about and queries for the following issue.

February 27 Advisory: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass [CVE-2026-20127]
- The following queries can be used to identify exposed SD-WAN Manager instances.

about 2 months ago

Upcoming Changes to Legacy Search Data and APIs

As part of the plan to decommission Legacy Search (search.censys.io) in 2026, Censys will update its host data backend on March 31, 2026. In Legacy Search, this will result in changes to virtual host behavior, data freshness, select API fields, and other minor adjustments. These changes are described in detail below.

These changes do not remove host coverage from Legacy Search. Additionally, this change does not affect Platform (platform.censys.io) data or functionality.

Overall host coverage, scan cadence, historical data retention, existing functionality, query syntax, UI workflows, and entitlements in Legacy Search are not impacted.

Virtual hosts

The table below summarizes key changes to virtual host data after the change.

Area	Before	After	Impact
Virtual host definition	One per each hostname and IP address	Based on latest scanned IP per port	Increased historical view of data
Service persistence	Up to 45 days	Removed on next negative scan	14-day expiry, yielding less stale data
IP association	Services persisted across IPs	Services move scan IPs	Data “may” move between IPs
Duplication	Common	Reduced	More accurate representation of web assets

Data freshness

Expiration is changing to 14 days (previously 45 days).
Index updates will occur only when a scan for that IP is received.
The "See Latest" UI indication may appear more often.
In general, there will be less long-lived stale data.

API and service lifecycle changes

Timeline API: Forward pagination will be removed. API users must set reversed=true.
Service lifecycle: Services pending removal will be immediately removed from assets when a scan indicates they are no longer visible, instead of being marked as pending.

Removed fields

The following fields will be removed from Legacy Search:

services.parsed.rocketmq.version (RocketMQ)
services.ipp.response (IPP)
services.ipp.cups_response (IPP)
services.elasticsearch.http_info (Elasticsearch)
services.tls.server_key_exchange (TLS)
services.prometheus.http_info (Prometheus)
services.transport_fingerprint.* (Transport)

DNS records

dns.records.record_type will no longer return CNAME.
Record types will be limited to A and AAAA only.

Certificate API update frequency

The update frequency for the following APIs will change from realtime to every six hours:

/v2/hosts/{ip}/certificates
/v2/certificates/{fingerprint}/observations

We encourage you to review your workflows and integrations to prepare for these upcoming changes. If you have any questions or concerns about this transition, please reach out to our team at [email protected].

about 2 months ago

February 23, 2026

Summary

Added eight new scanners for Cisco NSI, Flash Socket Policy, Melsec, Memberlist, RouterOS API, Rustdesk Heartbeat, Rustdesk Relay, and Rustdesk Rendezvous.
Added one new ASM risk fingerprint for exposed NextGen Healthcare Mirth Connect interfaces.

New protocols and application scanners

Added support for the following protocols and applications.

Protocol/application	Query	Data availability
`CISCO_NSI`	Platform query	Data is only visible to and searchable by Core and Enterprise users.
`FLASH_SOCKET_POLICY`	Platform query	Data is only visible to and searchable by Core and Enterprise users.
`MELSEC`	Platform query	Data is only visible to and searchable by users with access to the Critical Infrastructure module.
`MEMBERLIST`	Platform query	Data is only visible to and searchable by Core and Enterprise users.
`ROUTEROS_API`	Platform query	Data is only visible to and searchable by Core and Enterprise users.
`RUSTDESK_HEARTBEAT`	Platform query	Visible to and searchable by all user tiers.
`RUSTDESK_RELAY`	Platform query	Visible to and searchable by all user tiers.
`RUSTDESK_RENDEZVOUS`	Platform query	Visible to and searchable by all user tiers.

New fingerprints

Added the following fingerprint.

Note that new ASM risk fingerprints may be disabled by default in your workspace. Reference your risk type configuration in the ASM web console to review new risk types.

Type	Name	Description	Query
risk	Exposed NextGen Healthcare Mirth Connect	A NextGen Healthcare Mirth Connect administrator interface is exposed to the internet. Mirth Connect is healthcare integration software that processes and transforms medical data. Exposure may allow unauthorized access to sensitive health information.	ASM query: `risks.name: "Exposed NextGen Healthcare Mirth Connect"`

Type

Name

Description

Query

risk

Exposed NextGen Healthcare Mirth Connect

A NextGen Healthcare Mirth Connect administrator interface is exposed to the internet. Mirth Connect is healthcare integration software that processes and transforms medical data. Exposure may allow unauthorized access to sensitive health information.

ASM query:

risks.name: "Exposed NextGen Healthcare Mirth Connect"

2 months ago

February 17, 2026

Summary

Updated how web properties with multiple endpoints are displayed in the Platform web UI. They are now collected on a single hostname and port card instead of split across multiple cards.
Redirect chains, including start and end points, are now shown on host service and web endpoint cards in the Platform web UI.
Three new fingerprints for macOS, FortiClient EMS, and QuestDB.
One new Rapid Response advisory and queries for BeyondTrust Remote Support and Privileged Remote Access Flaw Allows Pre-Authentication RCE [CVE-2026-1731].

Platform

To improve usability, when web properties have multiple endpoints they are now collected on a single hostname and port card instead of split across multiple cards.
Redirect chains are now shown on host service and web endpoint cards.

New fingerprints

Added the following fingerprints.

Type	Name	Description	Query
operating_system	Apple macOS	This is a device running Apple macOS.	Platform query
software	Fortinet FortiClient Endpoint Management Server	This is a FortiClient Endpoint Management Server (EMS). EMS is a security management solution that enables scalable and centralized management of multiple endpoints.	Platform query
software	QuestDB	This is a QuestDB instance. QuestDB is an open-source time-series database.	Platform query

Rapid Response

The Censys Rapid Response team published information about and queries for the following issue.

February 10 Advisory: BeyondTrust Remote Support and Privileged Remote Access Flaw Allows Pre-Authentication RCE [CVE-2026-1731]
- The following queries can be used to identify exposed BeyondTrust Remote Support and Privileged Remote Access instances. Not all of these services are necessarily vulnerable.