Mapping CISA's September 2026 KEV Additions to Real-World Internet Exposure

CISA's Known Exploited Vulnerabilities catalog identifies flaws actively exploited in the wild, but does not indicate which affected systems are actually reachable in a given environment. September 2026 KEV additions notably include services such as GitLab, LiteLLM, and Cisco Secure Firewall Management Center — tools frequently internet-facing and holding credentials or controlling other systems. Internet measurement techniques, including fingerprinting via tools like ZoomEye, can partially bridge the gap by identifying reachable instances of these services. However, a fingerprint match confirms only that a service was observed at an address, not that it runs a vulnerable version or has been compromised. For services that cannot be reliably fingerprinted, internal inventory and continuous discovery remain the more dependable methods for assessing true exposure.