Mapping CISA's September 2026 KEV batch to measurable internet exposure

An analysis published on dev.to on 19 September 2026 takes the latest additions to CISA's Known Exploited Vulnerabilities (KEV) catalog and cross-references them against internet-wide scan data, turning an abstract list of actively exploited flaws into concrete exposure figures that teams can use to prioritise patching.

What landed in the September batch

Several of the CVEs added during the month share a profile: they affect services that are frequently reachable from the internet and that either hold credentials or control other systems.

According to the dev.to write-up:

• CVE-2026-85706 is an unauthenticated arbitrary file read in GitLab's repository commits API, carrying a CVSS 3.1 score of 10.0. GitLab shipped fixes in versions 19.3.2, 19.2.6 and 19.1.8 on 10 September 2026, and CISA added the flaw to KEV the next day.
• CVE-2026-20079 is a pre-authentication authentication bypass in Cisco Secure Firewall Management Center (FMC), also rated 10.0, with a companion static-credential flaw, CVE-2026-20316, rated 5.3. Cisco Talos attributes the exploitation to three tracked clusters.
• CVE-2026-59822 is an authentication bypass in BerriAI LiteLLM's MCP Streamable HTTP endpoint, patched in version 1.84.0, with a KEV remediation deadline of 16 September 2026.
• CVE-2026-56164 is a remotely exploitable, unauthenticated elevation of privilege in Microsoft SharePoint, fixed in July 2026 and added to KEV on 15 September 2026.
• CVE-2026-85880 and CVE-2026-81963 are the two exploited Windows zero-days from the September 2026 update, both rated 7.8, affecting the ALPC and Windows Update Stack components.

What the scans show

The author ran ZoomEye fingerprint queries on 19 September 2026. The GitLab fingerprint returned 1,262,273 matches in the IPv4 device dataset and 52,074 in the web dataset. The LiteLLM fingerprint returned 34,402 matches in the IPv4 device dataset. The Cisco FMC fingerprint returned zero matches, and a page-title search for "Firewall Management Center" returned a single result.

That contrast is the point of the exercise. GitLab and LiteLLM present identifiable content, so large populations are visible to passive scanning. FMC is a management console usually placed behind a VPN or jump host and reveals little that can be fingerprinted, so scanners see almost nothing. A near-zero count for a management plane is a statement about visibility, not evidence of a small attack surface.

Bridging KEV and your estate

The recommended sequence starts from the KEV list, identifies which entries correspond to services actually running in the environment, and then determines reachability for each.

For fingerprintable services such as GitLab and LiteLLM, the external view can be reconciled against internal records. Systems that appear externally but not internally are the ones most likely to sit outside the patch process, and each confirmed instance should be checked for version and whether the affected endpoint is reachable directly or only through a proxy.

For management planes such as FMC, the article argues external measurement is unreliable and inventory has to come from internal records and discovery. The author points to ZoomEye's attack surface management capability, which starts from an organisation's own asset clues and continuously discovers associated systems, surfacing machines that were never registered.

For the Windows zero-days, the relevant question is position rather than internet reachability: because ALPC and the Windows Update Stack are present on nearly every host, a 7.8-rated elevation of privilege is a tool for turning a foothold into control.

What the numbers do not say

None of the counts is a vulnerability count. A fingerprint match means the service was observed at that address, not that the version is affected and not that the relevant endpoint is reachable. The figures say nothing about whether any system has been compromised, and they cannot distinguish a deliberately published service from an accidentally exposed one.

Why it matters

The KEV catalog tells defenders what attackers are using; it does not tell them what is reachable in their own environment. The September 2026 batch illustrates both halves of that gap: enormous, easily observed GitLab and LiteLLM populations where external scanning can drive triage, and management consoles where scanning is effectively blind and only internal inventory work helps. For teams working against KEV deadlines, the method offers a practical way to prioritise: measure what can be measured, and treat near-zero scan results as a prompt to check internal discovery rather than as reassurance.