From KEV to Exposure: Mapping the September 2026 Batch to Measurable Services

The CISA Known Exploited Vulnerabilities catalog is a list of flaws that have been exploited in the wild. It is not a list of what is exposed in a given environment. Bridging those two things is the useful step, and internet measurement is one of the inputs that makes the bridge concrete. The September 2026 KEV additions provide a workable example.

The batch, briefly

Several additions in September 2026 share a theme: they affect services that are frequently reachable from the internet and that hold credentials or control other systems.
CVE-2026-85706 is an unauthenticated arbitrary file read in GitLab's repository commits API, CVSS 3.1 score 10.0, fixed on 10 September 2026 and added to KEV the next day. CVE-2026-20079 is a pre-authentication authentication bypass in Cisco Secure Firewall Management Center rated 10.0, with the companion static credential flaw CVE-2026-20316 rated 5.3, both exploited by three clusters tracked by Cisco Talos. CVE-2026-59822 is an authentication bypass in BerriAI LiteLLM's MCP Streamable HTTP endpoint, fixed in 1.84.0, with a 16 September 2026 KEV deadline. CVE-2026-56164 is a remotely exploitable, unauthenticated elevation of privilege in Microsoft SharePoint, fixed in July 2026 and added to KEV on 15 September 2026. CVE-2026-85880 and CVE-2026-81963 are the two exploited Windows zero-days from the September 2026 update, both rated 7.8.

What measurement adds

For each of these, the operational question is the same: how many of the affected systems are reachable from an untrusted network in this environment. Measurement answers that for the subset of services that can be fingerprinted reliably.
ZoomEye queries run on 19 September 2026 produced the following. The GitLab fingerprint returns 1,262,273 matches in the IPv4 device dataset and 52,074 in the web dataset. The LiteLLM fingerprint returns 34,402 matches in the IPv4 device dataset. The Cisco Secure Firewall Management Center fingerprint returns 0 matches, and a page title query for "Firewall Management Center" returns 1.
The pattern across these three is the point. GitLab and LiteLLM are highly fingerprintable, so a large population is observable. FMC is a management console that is usually placed behind a VPN or jump host and presents little identifying content, so passive fingerprinting sees almost nothing. A near-zero result for a management plane is a statement about visibility, not about a small attack surface.

Building the bridge

The useful sequence is to start from the KEV list, identify which entries correspond to services in your estate, and then determine reachability for each. Measurement contributes to the reachability step for services that can be fingerprinted, and it contributes differently for services that cannot.
For fingerprintable services such as GitLab and LiteLLM, the external view can be reconciled against internal records. Systems that appear externally but not internally are the ones most likely to sit outside the patch process. For each confirmed system, check the version and whether the affected endpoint is reachable directly or only through a proxy.
For management planes such as FMC, the external view is unreliable and the inventory has to come from internal records and discovery. ZoomEye's attack surface management capability is relevant here because it takes an organisation's own asset clues and continuously discovers associated assets, which surfaces systems that were never registered rather than relying on what a passive scan can see.
For the Windows zero-days, the relevant question is not internet reachability but position: a 7.8 elevation of privilege in the ALPC and Windows Update Stack components matters because those components are present on nearly every host and are used to move from a foothold to control.

What the numbers do not say

None of these counts is a vulnerability count. A fingerprint match means the service was observed at that address, not that the version is affected and not that the relevant endpoint is reachable. The counts do not say whether any system has been compromised, and they do not distinguish a deliberately published service from an accidentally exposed one.

The takeaway

The KEV catalog tells you what attackers are using. It does not tell you what is reachable in your estate. Measurement closes part of that gap for services that can be fingerprinted, and for management planes it mostly demonstrates the limits of the method, which is itself a reason to build the inventory from internal clues and continuous discovery.

References

• CISA Known Exploited Vulnerabilities catalog, September 2026 additions.
• GitLab patch release 19.3.2, 19.2.6, 19.1.8, 10 September 2026.
• Cisco Talos blog on exploitation of CVE-2026-20079 and CVE-2026-20316, 9 September 2026.
• GitHub security advisory GHSA-7488-6r32-c95q for CVE-2026-59822.
• CISA alert on SharePoint CVE-2026-56164, 15 September 2026.
• ZoomEye queries app="GitLab", app="LiteLLM", app="Cisco Secure Firewall Management Center" and title="Firewall Management Center", collected 19 September 2026.