From KEV to Exposure: Mapping the September 2026 Batch to Measurable Services
From KEV to Exposure: Mapping the September 2026 Batch to Measurable Services
从 KEV 到暴露面：将 2026 年 9 月批次漏洞映射至可测量的服务
The CISA Known Exploited Vulnerabilities catalog is a list of flaws that have been exploited in the wild. It is not a list of what is exposed in a given environment. Bridging those two things is the useful step, and internet measurement is one of the inputs that makes the bridge concrete. The September 2026 KEV additions provide a workable example. CISA 的“已知被利用漏洞”（KEV）目录列出了在野外被利用的漏洞，但它并非特定环境中暴露漏洞的清单。弥合这两者之间的差距是关键的一步，而互联网测量正是使这一桥梁具体化的输入之一。2026 年 9 月新增的 KEV 漏洞提供了一个可行的案例。
The batch, briefly: Several additions in September 2026 share a theme: they affect services that are frequently reachable from the internet and that hold credentials or control other systems. CVE-2026-85706 is an unauthenticated arbitrary file read in GitLab’s repository commits API, CVSS 3.1 score 10.0, fixed on 10 September 2026 and added to KEV the next day. CVE-2026-20079 is a pre-authentication authentication bypass in Cisco Secure Firewall Management Center rated 10.0, with the companion static credential flaw CVE-2026-20316 rated 5.3, both exploited by three clusters tracked by Cisco Talos. CVE-2026-59822 is an authentication bypass in BerriAI LiteLLM’s MCP Streamable HTTP endpoint, fixed in 1.84.0, with a 16 September 2026 KEV deadline. CVE-2026-56164 is a remotely exploitable, unauthenticated elevation of privilege in Microsoft SharePoint, fixed in July 2026 and added to KEV on 15 September 2026. CVE-2026-85880 and CVE-2026-81963 are the two exploited Windows zero-days from the September 2026 update, both rated 7.8. 简述该批次漏洞：2026 年 9 月新增的多个漏洞具有一个共同主题：它们影响的服务通常可从互联网访问，且持有凭据或控制其他系统。CVE-2026-85706 是 GitLab 存储库提交 API 中的未经身份验证的任意文件读取漏洞，CVSS 3.1 评分为 10.0，于 2026 年 9 月 10 日修复，并于次日加入 KEV。CVE-2026-20079 是 Cisco Secure Firewall Management Center 中的预身份验证绕过漏洞，评分为 10.0，伴随的静态凭据漏洞 CVE-2026-20316 评分为 5.3，两者均被 Cisco Talos 追踪的三个攻击集群所利用。CVE-2026-59822 是 BerriAI LiteLLM 的 MCP Streamable HTTP 端点中的身份验证绕过漏洞，在 1.84.0 版本中修复，KEV 截止日期为 2026 年 9 月 16 日。CVE-2026-56164 是 Microsoft SharePoint 中可远程利用的未经身份验证的权限提升漏洞，于 2026 年 7 月修复，并于 2026 年 9 月 15 日加入 KEV。CVE-2026-85880 和 CVE-2026-81963 是 2026 年 9 月更新中被利用的两个 Windows 零日漏洞，评分均为 7.8。
What measurement adds: For each of these, the operational question is the same: how many of the affected systems are reachable from an untrusted network in this environment. Measurement answers that for the subset of services that can be fingerprinted reliably. ZoomEye queries run on 19 September 2026 produced the following. The GitLab fingerprint returns 1,262,273 matches in the IPv4 device dataset and 52,074 in the web dataset. The LiteLLM fingerprint returns 34,402 matches in the IPv4 device dataset. The Cisco Secure Firewall Management Center fingerprint returns 0 matches, and a page title query for “Firewall Management Center” returns 1. The pattern across these three is the point. GitLab and LiteLLM are highly fingerprintable, so a large population is observable. FMC is a management console that is usually placed behind a VPN or jump host and presents little identifying content, so passive fingerprinting sees almost nothing. A near-zero result for a management plane is a statement about visibility, not about a small attack surface. 测量的价值：对于上述每一个漏洞，运营层面的问题都是一样的：在该环境中，有多少受影响的系统可以从不受信任的网络访问？对于那些可以可靠地进行指纹识别的服务子集，测量可以回答这个问题。2026 年 9 月 19 日运行的 ZoomEye 查询结果如下：GitLab 指纹在 IPv4 设备数据集中返回 1,262,273 个匹配项，在 Web 数据集中返回 52,074 个。LiteLLM 指纹在 IPv4 设备数据集中返回 34,402 个匹配项。Cisco Secure Firewall Management Center 指纹返回 0 个匹配项，而针对“Firewall Management Center”的页面标题查询返回 1 个。这三者呈现的模式正是关键所在：GitLab 和 LiteLLM 极易被指纹识别，因此可以观察到庞大的群体；而 FMC 是一个通常放置在 VPN 或跳板机后的管理控制台，几乎不呈现任何识别内容，因此被动指纹识别几乎一无所获。管理平面的近零结果反映的是可见性问题，而非攻击面较小。
Building the bridge: The useful sequence is to start from the KEV list, identify which entries correspond to services in your estate, and then determine reachability for each. Measurement contributes to the reachability step for services that can be fingerprinted, and it contributes differently for services that cannot. For fingerprintable services such as GitLab and LiteLLM, the external view can be reconciled against internal records. Systems that appear externally but not internally are the ones most likely to sit outside the patch process. For each confirmed system, check the version and whether the affected endpoint is reachable directly or only through a proxy. For management planes such as FMC, the external view is unreliable and the inventory has to come from internal records and discovery. ZoomEye’s attack surface management capability is relevant here because it takes an organisation’s own asset clues and continuously discovers associated assets, which surfaces systems that were never registered rather than relying on what a passive scan can see. For the Windows zero-days, the relevant question is not internet reachability but position: a 7.8 elevation of privilege in the ALPC and Windows Update Stack components matters because those components are present on nearly every host and are used to move from a foothold to control. 构建桥梁：有效的流程是从 KEV 列表开始，识别哪些条目对应于您资产中的服务，然后确定每个服务的可达性。对于可进行指纹识别的服务，测量有助于确定其可达性；对于无法识别的服务，其作用则不同。对于 GitLab 和 LiteLLM 等可识别服务，可以将外部视图与内部记录进行核对。出现在外部但未出现在内部记录中的系统，最有可能处于补丁流程之外。对于每个确认的系统，请检查版本以及受影响的端点是直接可达还是仅通过代理可达。对于 FMC 等管理平面，外部视图不可靠，资产清单必须来自内部记录和发现。ZoomEye 的攻击面管理能力在此处非常相关，因为它利用组织自身的资产线索持续发现关联资产，从而揭示那些从未注册过的系统，而不是仅仅依赖被动扫描所能看到的内容。对于 Windows 零日漏洞，相关的问题不是互联网可达性，而是位置：ALPC 和 Windows Update Stack 组件中 7.8 分的权限提升漏洞之所以重要，是因为这些组件几乎存在于每台主机上，并被用于从立足点转向完全控制。
What the numbers do not say: None of these counts is a vulnerability count. A fingerprint match means the service was observed at that address, not that the version is affected and not that the relevant endpoint is reachable. The counts do not say whether any system has been compromised, and they do not distinguish a deliberately published service from an accidentally exposed one. 数字背后的局限：这些统计数字并非漏洞数量。指纹匹配仅意味着在该地址观察到了该服务，并不代表该版本一定受影响，也不代表相关端点一定可达。这些统计数字无法说明系统是否已被入侵，也无法区分是故意发布的服务还是意外暴露的服务。
The takeaway: The KEV catalog tells you what attackers are using. It does not tell you what is reachable in your estate. Measurement closes part of that gap for services that can be fingerprinted, and for management planes it mostly demonstrates the limits of the method, which is itself a reason to build the inventory from internal clues and continuous discovery. 总结：KEV 目录告诉您攻击者正在使用什么，但它不会告诉您您的资产中哪些是可达的。测量为可进行指纹识别的服务弥补了部分差距；而对于管理平面，它更多地展示了该方法的局限性，这本身就是从内部线索和持续发现中构建资产清单的理由。