Four new fingerprints and two Rapid Response bulletins.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.

• Wazuh RCE Vulnerability Exploited to Deploy Mirai Botnets
  • Use the following queries to identify exposed Wazuh servers, but they are not necessarily vulnerable to the exploit.
    • Platform query
    • Legacy Search query
    • ASM query
    • ASM risk query
      • This query can be used to find instances of Wazuh server that are vulnerable to the exploit.
• Roundcube Webmail Vulnerable to Authenticated RCE [CVE-2025-49113]
  • Use the following queries to find Roundcube Webmail instances. Not all of these are necessarily vulnerable to the exploit described in the bulletin.
    • Platform query
    • Legacy Search query
    • ASM query
    • ASM risk query
      • This query can be used to find instances of Roundcube Webmail that are vulnerable to the exploit.

New fingerprints

Added the following fingerprints.

risks.name: `Vulnerable Wazuh [CVE-2025-24016]`

risks.name: `Vulnerable Roundcube [CVE-2025-49113]`

Platform Query Assistant beta for all users, Platform Threat Hunting module release, general availability for the Platform, two Rapid Response bulletins, several new risk fingerprints, and one new software fingerprint.

Platform

• Quickly generate valid search Censys Query Language (CenQL) queries using natural language input with the new Query Assistant tool in the Platform web UI.
  • Query Assistant is a beta feature available to all Platform users.
• Use the Platform Threat Hunting module to detect, analyze, and track threat infrastructure with speed and precision. The module enables you to explore the threat dataset with structured tools, historical context, and workflows. These capabilities help users validate threats in real time and uncover hidden clusters of malicious assets. The Threat Hunting module includes the following:
  • The Platform threat dataset that maps malware, threat actors, and tactics to services or endpoints running on exposed hosts and web properties.
  • Interactive Explore Threats page that provides a centralized view into internet-facing infrastructure linked to malware and threat actors. Use interactive visualizations, curated threat profiles, and simplified filtering to quickly identify relevant threats.
  • CensEye automated pivoting tool to help you identify web assets on the internet that share a specific key-value pair with an asset of interest to quickly pivot into related infrastructure.
  • Live Rescan and Discovery to run fresh scans on specific ports to instantly validate infrastructure behavior, detect configuration changes, and confirm asset persistence without waiting for scheduled Censys scans.
  • Certificate Timeline that provides a visual history of when a certificate presented itself on hosts and web properties. This visualization gives threat hunters historical context that simplifies the detection of patterns, trends, and anomalies that could signal malicious behavior.
• The Censys Platform is now generally available to all customers.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.

• ConnectWise ScreenConnect Vulnerability Added to CISA KEV [CVE-2025-3935]
  • Use the following queries to find instances of ConnectWise ScreenConnect. Not all of these are necessarily vulnerable, as specific version information may not be available.
    • Platform query
    • Legacy Search query
    • ASM query
    • ASM risk query
• vBulletin Allows Unauthenticated Users to Invoke Protected API Controllers’ Methods to Achieve RCE [CVE-2025-48827-48828]
  • Use the following Platform query to find vulnerable vBulletin instances. It requires a Starter or Enterprise plan, as it uses regex.
    • Platform query
  • Use the following queries to find vBulletin instances. Not all of these are necessarily vulnerable, as version-related information is not targeted using these queries.
    • Platform query
    • Legacy Search query
    • ASM query
    • ASM risk query

New fingerprints

Added the following fingerprints.

risks.name: `Insecure SNMP Service Exposed`

risks.name: `Vulnerable ConnectWise ScreenConnect [CVE-2025-3935]`

risks.name: `Vulnerable vBulletin [CVE-2025-48827]`

risks.name: `ASUS Backdoor IOC`

Sort, filter, and search options on the Collections page in the Platform web UI, two Rapid Response bulletins, and two new fingerprints.

Platform

• Added the ability to filter by owner, filter by category, search by name or ID, and sort by creation date, last updated date, or name on the Collections page in the Platform web UI.

  

Rapid Response

The Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.

• Ivanti EPMM Chained Exploits Added to CISA KEV [CVE-2025-4427-4428]
  • Use the following queries to find exposed Ivanti EPMM instances. Not all of these are necessarily vulnerable, as specific version information may not be available.
    • Platform query
    • Legacy Search query
    • ASM query
    • ASM risk query
• Samsung MagicInfo9 Path Traversal Vulnerability Added to CISA KEV [CVE-2025-4632]
  • Use the following queries to find exposed MagicInfo9 instances. Not all of these are necessarily vulnerable, as specific version information may not be available.
    • Platform query
    • Legacy Search query
    • ASM query

New fingerprints

Added the following fingerprints.

risks.name: `Vulnerable Ivanti Endpoint Manager Mobile [CVE-2025-4427 & CVE-2025-4428]`

Dark mode and CT logs page in the Platform web UI, improved filtering on the ASM Ports & Protocols dashboard, two new Rapid Response bulletins.

Platform

• Added dark mode to the Platform web UI. To switch between light and dark mode, click your profile icon and use the Light Mode / Dark Mode toggle.

  

• Use the new Certificate Transparency (CT) logs page in the Platform web UI to see the logs Censys monitors as well as additional certificate metadata.

  
  • This page always reflects the current state of Censys CT log monitoring.
  • Navigate to the page via the Help menu in the top-right corner of the Platform web console.

ASM

• Added the ability to filter the Ports & Protocols dashboard to a specific port range.

  

• Added a filter option for unknown protocols to the Ports & Protocols dashboard.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.

• Synacor Zimbra Collaboration Suite XSS Vulnerability Added to CISA KEV (CVE-2024-27443)
  • Use the following queries to Zimbra Collaboration Suite instances. Not all of these are necessarily vulnerable, as specific version information may not be available.
    • Platform query
    • Legacy Search query
    • ASM query
• Srimax Output Messenger Directory Traversal Vulnerability Added to CISA KEV (CVE-2025-27920)
  • Use the following queries to find instances of Srimax Output Messenger. Not all of these are necessarily vulnerable, as specific version information may not be available.
    • Platform query
    • Legacy Search query
    • ASM query

New fingerprints

Added the following fingerprints.

Eleven new software fingerprints and a Rapid Response bulletin.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.

• Stack-Based Buffer Overflow Vulnerability Affecting Multiple Fortinet Products [CVE-2025-32756]
  • Use the following queries to find Fortinet products. Not all of these are necessarily vulnerable, as specific version information may not be available.
    • Platform query
    • Legacy Search query
    • ASM query

New fingerprints

Added the following fingerprints.

An RSS feed for the Censys changelog is available here.

Four new software fingerprints and two Rapid Response bulletins.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.

• Critical RCE Vulnerability Identified in Craft CMS (CVE-2025-32432)
  • Use the following queries to find instances of Craft CMS. Not all of these are necessarily vulnerable, as specific version information may not be available.
    • Platform query
    • Legacy Search query
    • ASM query
• Unauthenticated Code Injection Vulnerability in Langflow (CVE-2025-3248)
  • Use the following queries to find exposed Langflow servers. Not all of these are necessarily vulnerable, as specific version information may not be available.
    • Platform query
    • Legacy Search query
    • ASM query

New fingerprints

Added the following fingerprints.

An RSS feed for the Censys changelog is available here.

Two new Rapid Response bulletins and two new software fingerprints.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.

• SAP NetWeaver Actively Exploited Unauthenticated File Upload Vuln (CVE-2025-31324)
• Critical Pre-Authentication RCE Vulnerability in Commvault Software (CVE-2025-34028)
  • Use the following queries to find internet-facing instances of Commvault software. Not all of these are necessarily vulnerable, as specific version information may not be available.
    • Platform query
    • Legacy Search query
    • ASM query

New fingerprints

Added the following fingerprints.

An RSS feed for the Censys changelog is available here.

New Platform web app landing page, Platform Report Builder improvements, and Ports & Protocols dashboard for ASM.

Platform

• Find the information you need in the Censys Platform faster using the new web app landing page. The new landing page includes a rotating selection of example queries, data aggregations, new onboarding steps, and more.

  

• Use the new Filter my results to display services or endpoints that match my query option on the Report Builder to limit the report results to only the services or endpoints that match your query. This option helps you build more focused reports.

  
  • The maximum number of report buckets has also been increased to 2,000.

• Integrate Censys Platform functionality with your automated workflows with the new Python and Go SDKs.

  • The Python SDK is also available on PyPI.

ASM

• The new Ports & Protocols Dashboard enables you to understand exactly which ports are open in your attack surface across the full 65,535-port range. This allows you to quickly determine whether there are any open ports that are misconfigured or non-compliant with your organization’s policy.

  
  • The dashboard also shows which protocols are present on your ports. ASM identifies whether these protocols are on standard ports, as defined by IANA.

New fingerprints

Added the following fingerprints.

An RSS feed for the Censys changelog is available here.

This release includes one new Rapid Response bulletin and four new software fingerprints.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.

• Unauthenticated RCE in Erlang/OTP (CVE-2025-32433)
  • Use the following queries to identify exposed Erlang SSH servers. Not all of these are necessarily vulnerable, as specific version information may not be available.
  • Platform query
  • Legacy Search query
  • ASM query

New fingerprints

Added the following fingerprints.

An RSS feed for the Censys changelog is available here.

This release features five new software fingerprints and two new ASM Rapid Response risks.

Rapid Response

The Censys Rapid Response team published information about and queries for the following issues and vulnerabilities.

• Vulnerability in FortiSwitch Allows Unauthenticated Attackers to Change Admin Passwords (CVE-2024-48887)
  • Use the following queries to find Fortinet FortiSwitch instances. Not all of these are necessarily vulnerable, as specific version information may not be available.
  • Platform query
  • Legacy Search query
  • ASM query
• Actively Exploited Deserialization Vulnerability in Gladinet CentreStack Secure File Sharing Software (CVE-2025-30406)
  • The queries below can be used to identify exposed instances of Gladinet CentreStack, but they are not necessarily vulnerable to the exploit.
  • Platform query
  • Legacy Search query
  • ASM query
  • ASM risk query
    • This query can be used to identify exposed instances of Gladinet CentreStack that are vulnerable to the exploit.

New fingerprints

Added the following fingerprints.

An RSS feed for the Censys changelog is available here.