October 13, 2026

Summary

• Data about post-quantum cryptography (PQC) key exchange groups is now available on host services and web property endpoints.
• Version 1.2.0 of Censys Splunk Platform integration was released, adding the ability to use the get host enrichment API and several other improvements.
• The ASM integration with Microsoft Sentinel has been updated to use the log ingestion API instead of the retired Azure Monitor HTTP data collection API.
• Fixed bugs related to risk instance counts and risk acceptance appearing in change history in ASM.
• Added five new fingerprints to the Platform.
• Three new Censys ARC Rapid Response advisories for MikroTik RouterOS Web Management Unauthenticated Remote Code Execution [CVE-2026-84411], Atlassian Data Center Arbitrary File Access [CVE-2026-21589], and SonicWall SMA1000 Work Place Pre-Authentication SSRF [CVE-2026-102255].

Platform

• Data about post-quantum cryptography (PQC) key exchange groups is now available on host services and web property endpoints.
  • Use this information to determine whether a server or application supports quantum-resistant algorithms like ML-KEM (Kyber) and hybrid key exchanges like X25519MLKEM768.
  • This information is availablekey_exchange_group and pqc_groups fields on host services and web property endpoints. in the new
    • key_exchange_group contains the exchange group selected by the server, such as the TLS 1.3 key share group or the TLS 1.2 ECDHE curve.
    • pqc_groups contains the post-quantum groups the server accepts.
  • This data is highlighted in the TLS Handshake section of a service or endpoint card in the Platform UI.
  • This new data is available to all users.
• Version 1.2.0 of Censys Splunk Platform integration was released.
  • Added support for the host enrichment API.
    • You can now configure the integration to call the get host enrichment API endpoint by default instead of the get host API endpoint.
  • Added a workflow action and a custom command for related infrastructure data.
  • Added a Splunk ES adaptive response for related infrastructure data.
  • Added new data enrichment fields for reputation score, GreyNoise, IPinfo, and Mallory.
  • Raised the minimum required Python version to 3.13.

ASM

• The ASM integration with Microsoft Sentinel has been updated to use the log ingestion API instead of the retired Azure Monitor HTTP data collection API.
  • Microsoft retired the Azure Monitor HTTP data collection API on September 14, 2026.
  • Information about how to use the data sent to Sentinel from the legacy API is still provided in the documentation, but Censys recommends using the log ingestion API configuration for new setups.

Bug fixes

• Fixed two bugs that caused an incorrect count of total and accepted risks to appear on the risk instance table in the ASM console.
• Fixed a bug that caused accepting a risk to not be recorded in Change History or on the asset details page for hosts and web entities.

New fingerprints

Added five new fingerprints to the Platform.

Censys ARC Rapid Response

The Censys ARC team published information about the following issues.

• Oct 5 Advisory: MikroTik RouterOS Web Management Unauthenticated Remote Code Execution [CVE-2026-84411]
  • The following queries can be used to identify exposed instances. Not all of these services are necessarily vulnerable.
    • Platform query (hosts)
    • Platform query (web properties)
• Oct 7 Advisory: Atlassian Data Center Arbitrary File Access [CVE-2026-21589]
  • The following query can be used to identify exposed instances.
    • Platform query
• Oct 7 Advisory: SonicWall SMA1000 Work Place Pre-Authentication SSRF [CVE-2026-102255]
  • TThe following queries can be used to identify exposed instances. Not all of these services are necessarily vulnerable.
    • Platform query