Censys Adds 22 Scanners to Map Internet-Exposed Services

Oct 8, 2026 · Original article ↗

Summary

Censys added 22 protocol and endpoint scanners in September, highlighting exposed Cisco SD-WAN, fuel controllers, alarm systems, Hikvision recorders, STOMP brokers, and Pigeonhole services, with security risks and advice to check exposure and patch systems.

Key points

Censys says 11,180 Cisco SD-WAN control planes are Internet-reachable; an unauthenticated exchange can reveal an organization name, device identifier, and site ID. Cisco SD-WAN flaws have been added to CISA’s Known Exploited Vulnerabilities catalog, and active exploitation has been confirmed.
Internet-exposed FSC3000 fuel controllers disclose site identity, while exposed C-Nord alarm systems may reveal live alarm status, event history, and keyholder names. The article reports no known exploitation of either exposure.
Hikvision’s DNVRS-Webs daemon enables remote configuration and video access for DVRs and NVRs, potentially exposing a site’s camera fleet.
STOMP brokers have a history of exploitation, including by ransomware actors. The article cites an actively exploited ActiveMQ flaw, CVE-2026-34197, and a STOMP-specific denial-of-service flaw, CVE-2026-53916.
Exposed Pigeonhole services may be running vulnerable Dovecot releases; the article cites fixes for a crash-triggering bug and a stack buffer underflow.
Censys recommends checking whether the highlighted services are Internet-reachable and verifying that affected systems and brokers are patched. Queries for each scanner are provided in the article.

Article Details

Event Type: Censys added 22 protocol and endpoint scanners to its Internet-mapping platform in September 2026; the article spotlights exposed services and discusses related vulnerabilities and exploitation.
Impact: The scanners identify Internet-reachable control planes and systems that may disclose organization, device, site, alarm, or keyholder information, or expose camera, messaging, and email infrastructure. The article reports active exploitation of Cisco SD-WAN flaws and prior ransomware use of ActiveMQ vulnerabilities, but says no active campaign has been tied to the FSC3000 exposure and no exploitation is known for the C-Nord exposure.