Summary

• New twist function for Platform search queries.
• Added matched services for search results in the Platform UI and API.
• New fingerprints for popular KVM products and Ollama.
• One Rapid Response bulletin for an RCE in Cisco IOS and IOS XE software.

Platform

• Use the new twist function in your Platform queries to find field values that are similar to a specified value.

  • You can use the twist function to find typosquatted domains or domains attempting to impersonate a valid domain by omitting known domains from your query. For example, the following query will find web properties that use names similar to censys.io but will omit results that include censys.io.

    * * twist(web.hostname, 'censys.io') and not web.hostname:'censys.io'

• Use matched services in the UI and API to rapidly find host services that contain data that match your search criteria.

  • Matched services in the UI are shown in the Matched Fields section. Click the service icon to navigate directly to the service card on the host.

    

  • Matched services in the API are returned in a matched_services object for each host that contains matching data.

              "matched_services": [
                {
                  "protocol": "HTTP",
                  "port": 18083,
                  "transport_protocol": "tcp"
                }
              ]

• The Share link action was moved to the Search Actions menu next to the search bar in the Platform web UI. Use this to generate share links for assets, search query results, and more.

  

Rapid Response

The Censys Rapid Response team published information about and queries for the following issue.

• SNMP RCE in Cisco IOS and IOS XE Software [CVE‑2025‑20352]
  • The queries below can help identify any affected Cisco devices exposing SNMP, but they are not necessarily vulnerable.
    • Platform query
    • Legacy Search query
    • ASM query

New fingerprints

Added the following fingerprints.

Summary

• Free users now have access to Platform lookup API endpoints..
• Two new risk fingerprints for ASM.
• One new fingerprint for atvremote servers.

Platform

API

• Platform lookup API endpoints may now be used by Free users.

  • Lookup endpoints cost 1 credit per asset retrieved, which is the same cost to look up assets in the Platform web UI.

  • Free users can create Personal Access Tokens in the Platform web UI to execute API calls.

  • The lookup endpoints no longer require an organization ID to be executed.

    • If you have access to a Starter or Enterprise organization ID and do not include it in your lookup API call, then the cost is deducted from your Free credit balance. Additionally, the endpoint will only return data that is available to Free users.

  • Free users have access to the following API endpoints:

    • Get a certificate (and get a certificate in PEM format)
    • Retrieve multiple certificates (and retrieve multiple certificates in PEM format)
    • Get a host
    • Retrieve multiple hosts
    • Get a web property
    • Retrieve multiple web properties

New fingerprints

Added the following fingerprints.

risks.name: `GoAnywhere MFT Deserialization Vulnerability [CVE-2025-10035]`

risks.name: `Exposed atvremote Device`

Summary

• New Threat Hunting MCP Server to give your AI agents access to Censys Threat Hunting APIs, empowering you to find and investigate potential threats at machine speed.
• Two new scanners for Crestron over IP and MikroTik WinBox.
• New SAP NetWeaver AS Java and Sitecore Experience Platform risk fingerprints for ASM.

Platform

Threat Hunting Module

• Use the Threat Hunting Model Context Protocol (MCP) Server to give your AI agents access to Censys Threat Hunting APIs, empowering you to find and investigate potential threats at machine speed.

New protocol and application scanners

Added scanners for the following services.

New fingerprints

Added the following fingerprints.

risks.name: `Vulnerable SAP NetWeaver AS Java [CVE-2025-42922]`

risks.name: `Vulnerable Sitecore Experience Platform [CVE-2025-53690]`

Summary

• Added the ability to log in to the Platform using Google.
• One new fingerprint for Cisco Secure Firewall Management Center.

Platform

• Added the ability to log in to the Platform using Google.

New fingerprints

Added the following fingerprint.

Summary

• Cloud CDN Identification for ASM to map CDN presence in your attack surface.
• One new ASM risk for Citrix Netscaler.

ASM

• Use Cloud CDN Identification with ASM Cloud Connectors to understand CDN presence in your attack surface.
  • Cloud CDN Identification finds Azure Front Door CDN and AWS CloudFront software and reports it in the software data provided for host services and web entity instances. You can search for these Cloud CDNs in your inventory by performing a full-text search for the applicable service (such as "CloudFront" or "Front Door") or by searching for the product name in host.services.software.product or web_entity.instances.software.product.
  • All newly set up Azure and AWS Cloud Connectors will ingest cloud CDN information by default. Customers with existing Azure and AWS Cloud Connector configurations need to manually update their Cloud Connectors to begin ingesting this data. To update your Cloud Connector to ingest Cloud CDN data:
    1. In the ASM web console, go to Integrations, find your Cloud Connector integration, and click Manage.
    2. In the configuration panel, click Edit Configuration, then click Next Step. Click Next Step again.
    3. Click Close. Your Cloud Connector is now updated.

New fingerprints

Added the following fingerprint.

risks.name: `Vulnerable Citrix Netscaler Application [CVE-2025-7775, CVE-2025-7776, CVE-2025-8424]`

Summary

• New historical hosts for a certificate API endpoint.
• Several enhancements for the Investigation Manager to make it easier to create, navigate, and pivot from investigations.
• A new fingerprint for N-able N-central.
• Two new risks for ASM.

Platform

Threat Hunting

• Use the get host history for a certificate API to retrieve the historical observations of hosts associated with a certificate. This is useful for threat hunting, detection engineering, and timeline generation.

Investigation Manager

• Added the ability to create investigations directly from host, certificate, web property, and collection pages.

  

• Added an asset node details card for hosts that includes geographic location, labels, reverse and forward DNS, service ports and protocols, and more contextual data. This card appears when you click on host nodes in the investigation manager UI.

  

• Added a minimap to the bottom right corner of the investigation UI to make it easier to navigate your investigations.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issue.

• Plex Warns Users to Patch Security Vulnerability in Plex Media Server
  • Use the following queries to find Plex Media Server login portals. Not all of these are necessarily vulnerable.
    • Platform query
    • Legacy Search query
    • ASM query

New fingerprints

Added the following fingerprints.

risks.name: `WDBRPC Service Exposed`

risks.name: `Vulnerable N-able N-central [CVE-2025-8875 & CVE-2025-8876]`

Summary

• New MCP server for ASM.
• New Platform scan and query converter APIs.
• One new fingerprint for Wavlink routers.
• Learn more about these updates here.

ASM

• Use the ASM Model Context Protocol (MCP) Server to give your AI agents and workflows secure, governed, and direct access to your ASM inventory, empowering you to explore and understand your attack surface at machine speed.

Platform

API

• Added new API endpoints for Live Rescan, Live Discovery, and retrieving scan status.
• Added a new API endpoint for converting Legacy Search queries into Platform queries.

Bug fixes

• Fixed an issue that caused some large number values, such as Cobalt Strike watermarks, to display in scientific notation.

New protocols and application scanners

Added support for the following protocols and applications.

New fingerprints

Added the following fingerprint.

Beginning August 21, 2025, ICANN will require registrars to deactivate WHOIS in favor of RDAP (Registration Data Access Protocol). Censys Attack Surface Management (ASM) currently uses WHOIS data for attribution purposes.

The registration data provider used for ASM's attribution process supports RDAP, but expects disruptions after August 21, 2025. Censys has mitigations in place to minimize the issues that may occur as a result of this change. Additionally, Censys' attribution process supports RDAP for asset discovery.

This document provides additional context about this issue and Censys' plan to navigate the switch from WHOIS to RDAP.

Background and ASM context

WHOIS is a protocol that is used for collecting domain and CIDR registration data. It has been the internet standard for several decades, but ICANN has announced the EOL of WHOIS in favor of RDAP, a more modern registration data protocol.

On January 28, 2025, domain registrars were no longer required by ICANN to support WHOIS. Beginning August 21, 2025, registrars are required to stop supporting WHOIS in favor of RDAP.

ASM uses WHOIS registration information for its attribution, specifically for domain and CIDR discovery. These domains and CIDRs are then used to attribute assets to each workspace.

To date, only 13% of domains have been migrated to RDAP, so extensions are likely beyond August 21, 2025. However, customers may experience disruption to WHOIS data after this date.

Mitigation plan

Censys is in constant contact with its WHOIS and RDAP data provider to minimize data loss.

Censys' WHOIS data provider has updated their API to automatically check for RDAP if WHOIS returns no data. In addition, Censys will pull RDAP data after August 21, 2025.

If both WHOIS and RDAP return no data for valid, non-expired domains with existing registrant information, Censys plans to cache the domains until data is returned.

Download search results for Core and Enterprise Platform users, new Platform API endpoints for retrieving certificates in PEM format, new fingerprints for Papercut print servers and Oracle E-Business Suite, two new risks for ASM, and one Rapid Response bulletin on a flaw affecting Microsoft Exchange hybrid deployments.

Platform

• Core and Enterprise users can now download search results in CSV format in the Platform UI.

  
  • Each page of results must be downloaded separately.
  • Each CSV file can contain a maximum of 100 results.

API

• Added two new API endpoints to retrieve a single certificate or multiple certificates in PEM format.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issue.

• High-Severity Flaw Affecting Microsoft Exchange Hybrid Deployments [CVE-2025-53786]
  • Use the following queries to find Exchange servers that may or may not have an OWA portal present. Not all of these are necessarily vulnerable. Read the blog for more information about finding OWA portals and hosts with Exchange servers and OWA portals on the same device.
    • Platform query
    • Legacy Search query
    • ASM query
    • ASM risk query

New fingerprints

Added the following fingerprints.

risks.name: `Vulnerable Exchange Server [CVE-2025-53786]`

risks.name: `Vulnerable Papercut Print Server CVE-2023-2533`

Query Assistant improvements in the Platform and seventeen risks enabled for ASM, including numerous service exposures like WINRM and DCERPC.

Platform

• You no longer need to click the generate button to convert natural language input into a Censys Query Language query using the Query Assistant. Instead, the query assistant now automatically converts natural language after you enter it.

ASM

The following risks are now enabled for all ASM customers.