Summary

• New Rapid Response advisory and queries for Ivanti Endpoint Manager Stored XSS Vulnerability [CVE-2025-10573].
• New software fingerprints for n8n servers and Apache Tika servers.
• New ASM risk fingerprints for Fortinet products vulnerable to CVE-2025-59718 and CVE-2025-59719 and Ivanti Endpoint Manager instances vulnerable to CVE-2025-10573.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issue.

• Ivanti Endpoint Manager Stored XSS Vulnerability [CVE-2025-10573]
  • The following queries can be used to identify exposed Ivanti EPM instances.
    • Platform query
    • Legacy Search query
  • The following queries can be used to identify exposed and vulnerable Ivanti EPM instances.
    • Platform query (requires Starter license or above to use regex)
    • Legacy Search query
    • ASM risk query

New fingerprints

Added the following fingerprints.

risks.name: `Vulnerable Ivanti Endpoint Manager [CVE-2025-10573]`

risks.name: `Vulnerable Fortinet Products [CVE-2025-59718, CVE-2025-59719]`

Summary

• Use aliased fields in the Platform to search across multiple fields at once and quickly find relevant assets.
• New Rapid Response advisories and queries for:
  • Unauthenticated RCE Flaw in React Server Components [CVE-2025-55182]
  • Critical XXE Injection Bug in Apache Tika [CVE-2025-66516]
  • pgAdmin4 Allows RCE via PLAIN-format Dump File Restore [CVE-2025-12762]
• New software fingerprints for Waku, pgAdmin4, and Ferron web servers.
• New ASM risk fingerprints for React2Shell and pgAdmin4 CVE-2025-12762.

Platform

• Some fields are now grouped into aliases to make it easier to search across multiple fields at once. Aliases can be used in the Platform web UI or API. The complete list of aliases and their mapped fields is available in the documentation.

  

Rapid Response

The Censys Rapid Response team published information about and queries for the following issues.

• Unauthenticated RCE Flaw in React Server Components [CVE-2025-55182]
  • The following queries can be used to identify exposed React Server components.
    • Platform query
    • Legacy Search query
    • ASM query
    • ASM risk query
• Critical XXE Injection Bug in Apache Tika [CVE-2025-66516]
  • The queries below can identify potentially vulnerable Tika instances.
    • Platform query
    • Legacy Search query
    • ASM query
• pgAdmin4 Allows RCE via PLAIN-format Dump File Restore [CVE-2025-12762]
  • The queries below can help identify potentially vulnerable pgAdmin4 instances.
    • Platform query
    • Legacy Search query
    • ASM risk query

New fingerprints

Added the following fingerprints.

risks.name: `React2Shell: Unauthenticated RCE in React Server Components [CVE-2025-55182]`

risks.name: `Vulnerable pgAdmin 4 [CVE-2025-12762]`

Summary

• Added the ability to secure your Platform account with multi-factor authentication. Organization admins can enforce MFA for all members of their organization.
• Use weekly collection digest emails to track changes to your saved Platform queries over time.
• Two Rapid Response advisories for XWiki and FortiWeb issues.
• Added fingerprints for Frigate NVR and XWiki and an ASM risk fingerprint for XWiki instances vulnerable to CVE-2025-24893.

Platform

• You can now add another layer of security to your Platform account with multi-factor authentication (MFA) using an authenticator app.

  
  • Configure your personal MFA settings in Settings > Account Management > Personal Settings > Security.
  • Organization admins can configure MFA enforcement for their organization in Settings > Account Management > Organization Settings > Security.

• Use collection email notifications to receive weekly messages about updates to your collections. Emails are sent to the email address associated with your user account.

  

Rapid Response

The Censys Rapid Response team published information about and queries for the following issues.

• XWiki Platform Allows Unauthorized RCE Via RondoDox Botnet [CVE-2025-24893]
  • The queries below can help identify exposed XWiki instances, but they cannot determine whether systems are vulnerable.
    • Platform query
    • Legacy Search query
    • ASM query
• FortiWeb Vulnerability Allows Authenticated OS Command Injection [CVE-2025-58034]
  • The queries below can identify FortiWeb instances but do not filter by version.
    • Platform query
    • Legacy Search query
    • ASM query

New fingerprints

Added the following fingerprints.

risks.name: `Vulnerable XWiki [CVE-2025-24893]`

Summary

• New AI summary functionality for host assets.

Platform

• Use the new Summarize host functionality on host assets in the UI to quickly generate a concise, human-readable summary of the asset using the Censys Assistant.

  
  • This feature is available to Starter and Enterprise users.

Summary

• New Platform Account Management API endpoints for programmatic organization management and credit monitoring.
• New fingerprint for Cisco IOS-XE endpoints.

Platform

• Use the Account Management API to programmatically manage your organization and monitor credit consumption. New endpoints are available for the following actions:

  • Get organization details
  • Get organization credit statistics
  • Get organization credit usage
  • Invite user to organization
  • List organization members
  • Remove member from organization
  • Update an organization member's roles
  • Get member credit usage

New fingerprints

Added the following fingerprint.

Summary

• Collections are now available to all Free users.
• One new fingerprint for Tesla Wall Connectors and one new ASM risk fingerprint for exposed Apache ZooKeeper services.

Platform

• Free users can now create and monitor collections in the Platform web console.

  

  • Collections let you track changes to internet-facing infrastructure to stay proactive about threats and vulnerabilities using a saved Censys query, so you can spend less time searching and more time taking action.
  • Free user collections are limited to 100 assets.

New fingerprints

Added the following fingerprints.

Summary

• Four risks for exposed Watchguard Firewalls, WDBRPC services, atvremote devices, and KVM devices are now enabled for ASM customers.
• One new ASM risk fingerprint for BIND 9 resolvers vulnerable to CVE-2025-40778 and one Rapid Response bulletin for this vulnerability.

ASM

The following risks have now been enabled by default for all ASM customers.

• Exposed Watchguard Firewall
• WDBRPC Service Exposed
• Exposed atvremote Device
• Exposed KVM

Rapid Response

The Censys Rapid Response team published information about and queries for the following issue.

• BIND 9 Resolver Enables Cache Poisoning Via Unsolicited Answers [CVE-2025-40778]
  • The queries below can identify vulnerable BIND 9 resolvers.
    • Platform query
    • Legacy Search query
    • ASM risk query

New fingerprints

Added the following fingerprint.

An RSS feed for Censys release notes is available here.

Summary

• Rapid Response advisory and queries for exposed F5 BIG-IP products affected by recent nation-state breach.
• Threat data now visible for Platform Enterprise customers.
• One new fingerprint for Interactsh servers.

Platform

• Some threat data for hosts and web properties is now viewable by all users on Enterprise accounts.

  

  • The following fields can be seen in the Platform web console and retrieved via API, but may not be searched for or pivoted across unless you also have access to the Threat Hunting module.

    Data field	Description
    *.threats.id	A unique identifier for the threat.
    *.threats.name	Name of the threat, such as Cobalt Strike.
    *.threats.tactic	How the threat behaves and the purpose of the activity, such as COMMAND_AND_CONTROL and PERSISTENCE.
    *.threats.type	The role of the service, such as PHISHING_SERVER and WEBSHELL.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issue.

• Nation-State Breach of F5 Networks — Exposure of BIG-IP Source Code & Undisclosed Vulnerabilities
  • The queries below can identify F5 BIG-IP instances, but they cannot determine whether systems are vulnerable.
    • Platform query
    • Legacy Search query
    • ASM query

New fingerprints

Added the following fingerprint.

Summary

• New cencli command line tool to bring Platform features and data to your terminal.
• Censys Assistant in the Platform web console for rapid investigations using natural language input.
• Support for integrating the Censys ASM MCP Server with Microsoft Copilot Studio.
• New fingerprints for Ivanti Endpoint Manager, Oracle Cloud Infrastructure Load Balancer, and Oracle Traffic Director.
• One new ASM risk fingerprint for Redis servers vulnerable to CVE-2025-49844.

Platform

• The cencli command line tool enables you to run search queries, look up assets, perform aggregations, and more from your terminal window.

  
  • cencli can be used by all registered Platform users.

• Use the Censys Assistant AI tool in the Platform web console to input questions in a natural language and obtain answers based on the assets and data present in the Censys Internet Map.

  
  • The Censys Assistant is available to all Starter and Enterprise users.

ASM

• Integrate the Censys ASM MCP Server with Microsoft Copilot Studio to seamlessly incorporate Censys ASM functionality with your AI tools.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issues.

• Pre-Auth RCE Chain in Oracle E-Business Suite Software [CVE-2025-61882]
  • The queries below can help identify Oracle E-Business Suite instances, but they cannot determine whether systems are vulnerable.
    • Platform query
    • Legacy Search query
    • ASM query
• 13 Unpatched Zero-Days in Ivanti Endpoint Manager Enabling RCE
  • The following queries can help identify exposed Ivanti Endpoint Manager / LANDesk instances, but they are not necessarily vulnerable.
    • Platform query
    • Legacy Search query
    • ASM query

New fingerprints

Added the following fingerprints.

risks.name: `Vulnerable Redis Server [CVE-2025-49844] - RediShell`

Summary

• New Insights experience in ASM to help you understand key data points about your attack surface.
• Unauthenticated access to Platform for easy browsing.
• New software fingerprints for RustDesk Console, Progress Chef Automate, and ligolo-ng.
• A new risk for exposed KVM devices for ASM.

ASM

• Use Insights in ASM to stay on top of key security initiatives like software compliance and vulnerability management.

  
  • Insights organizes and presents key data points about your attack surface, like the state of your inventory's software and services, in an understandable and easily actionable format.
  • The Insights search bar provides several pre-formatted prompts to help you investigate your inventory and learn how to build useful ASM queries.
  • Insights is available to all ASM users.

Platform

• Added the ability to use the Platform without logging in to an account. Use this functionality to look up assets, perform searches, and view shared Platform links.
  • Unauthenticated users can perform a maximum of five actions before they must log in.

New fingerprints

Added the following fingerprints.

risks.name: `Exposed KVM`