Release Notes
Back to All

September 14, 2026

about 2 hours ago

Summary

  • Added a case-insensitive regex string operator, (?i), to the Censys Query Language (CenQL).
  • Added 22 new protocol, application, and endpoint scanners to the Platform.
  • Added two new risk fingerprints to ASM.

Platform

  • Add the new (?i) operator to the start of a regex string in CenQL queries to make it case-insensitive.
    • For example, the following query will return all hosts with an nginx server using a non-standard casing of the server value. 
      host.services.endpoints.http.headers:(key="Server" and value=~"(?i)^nginx$" and not value="nginx")

New protocol, application, and endpoint scanners

Added the following protocol, application, and endpoint scanners to the Platform.

Protocol, application, or endpoint typeDescriptionData availabilityQuery
UTILINET_LPPLandis+Gyr Gridstream RF / UtiliNet head-end LAN Packet Protocol listener for utility AMI and distribution automation.Available to users with access to the Critical Infrastructure module.Platform query
ORENCO_ATRTUOrenco AdvanTex wastewater-treatment RTU pre-login VT100 screen.Available to users with access to the Critical Infrastructure module.Platform query
OPW_FSC3000OPW Fuel Management Systems FSC3000 card-lock fuel site controller console.Available to users with access to the Critical Infrastructure module.Platform query
PIGEONHOLEDovecot Pigeonhole Sieve implementation.Available to Starter, Search, and Core users.Platform query
SAMSUNG_OFFICESERVSamsung OfficeServ Device Manager link.Available to Starter, Search, and Core users.Platform query
CISCO_SDWAN_VDAEMONCisco Catalyst SD-WAN vManage/vSmart vdaemon TLS control plane.Available to Starter, Search, and Core users.Platform query
VANTAGE_INFUSIONVantage InFusion whole-home automation controller (lighting, shade, HVAC, AV).Available to Starter, Search, and Core users.Platform query
CNORD_SECURITY_CENTERC-Nord central alarm monitoring station (PTsN) inter-module bus.Available to Starter, Search, and Core users.Platform query
VISIONHITECH_IPCAMIP cameras behind ipTIME routers.Available to Starter, Search, and Core users.Platform query
OTLP_GRPCOpenTelemetry OTLP gRPC receiver.Available to all users.Platform query
NETFLIX_NRDPNetflix Ready Device Platform status endpoint on certified set-top boxes, smart TVs and streaming devices.Available to all users.Platform query
HIKVISION_DNVRSHikvision private DNVRS-Webs DVR/NVR management daemon.Available to all users.Platform query
SPOTIFY_CONNECTSpotify Connect Zeroconf API getInfo endpoint.Available to all users.Platform query
MANAGESIEVEManageSieve (RFC 5804), remote management of Sieve mail-filter scripts.Available to all users.Platform query
LIBP2Plibp2p multistream-select negotiation.Available to all users.Platform query
TAURUS_STBUnauthenticated "taurus" debug shell on satellite IPTV set-top boxes (Skylife / KT).Available to all users.Platform query
GEOVISION_AUDIOAudio channel of GeoVision GV-VMS / GV-NVR and GV-Series IP cameras.Available to all users.Platform query
BLUEMAX_NUTTCPnuttcp network-benchmark control daemon bundled on BLUEMAX NGF firewall appliances.Available to all users.Platform query
WOW_REALMDWorld of Warcraft realmd logon server; Blizzard realms plus MaNGOS, TrinityCore and AzerothCore emulators.Available to all users.Platform query
THRULAYthrulay network-performance measurement daemon.Available to all users.Platform query
STOMPSimple Text Oriented Messaging Protocol over TCP.Available to all users.Platform query
CLAMAVclamd, the ClamAV anti-malware scanning daemon (Cisco Talos).Available to all users.Platform query

New risks

Added two new risk fingerprints to ASM.

Note that new ASM risk fingerprints may be disabled by default in your workspace. Reference your risk type configuration in the ASM web console to review new risk types.

NameDescriptionQuery
Vulnerable GitLab Server (CVE-2026-85706)The affected GitLab application is running an out-of-date version and is vulnerable to CVE-2026-85706. An unauthenticated attacker can read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
risks.name: "GitLab Server (CVE-2026-85706)"
Vulnerable GitLab Server (CVE-2026-87719)The affected GitLab Enterprise Edition application is running an out-of-date version and is vulnerable to CVE-2026-87719. An authenticated user holding Duo Chat access can obtain Advanced Search instance configurations and sensitive credentials through a crafted GraphQL subscription argument that bypasses serialization and performs a server object lookup.
risks.name: "Vulnerable GitLab Server (CVE-2026-87719)"