{
  "id": 9733650,
  "title": "5,102,346 Hosts on Port 5900: VNC and the Legacy Remote-Access Surface",
  "url": "https://urgent.news/2026/09/25/5-102-346-hosts-on-port-5900-vnc-and-the-legacy-remote-access-surface",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-25T08:00:38.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/jeffreyciend/5102346-hosts-on-port-5900-vnc-and-the-legacy-remote-access-surface-3l8b"
  },
  "original_language": "en",
  "account": "As of September 23, 2026, it was discovered that there are an estimated 5,102,346 hosts running the Virtual Network Computing (VNC) service on port 5900. VNC is a remote access protocol that predates many modern security assumptions and has a weak authentication scheme that can be vulnerable to offline attacks. While later versions of the protocol offer stronger security options, VNC is still frequently deployed without encryption, allowing credentials and session content to be observed on the network.\n\nThe data comes from a ZoomEye query that returned 5,102,346 matches for open port 5900. It should be noted that this query only identifies the presence of VNC but does not confirm its deployment or security configuration. VNC is commonly used in virtual machine consoles, kiosk systems, industrial equipment, and embedded devices where a graphical interface is necessary, and a full remote desktop stack may not be desired.\n\nThe security of VNC deployments varies greatly. Configurations where the VNC server is bound to localhost and accessed through an SSH tunnel present a reasonable level of security. However, VNC servers running on public interfaces with weak passwords are significantly less secure. The count provided does not differentiate between these two potential vulnerabilities, so it should be viewed as a measure of how much of the VNC protocol is accessible rather than how much is specifically vulnerable.\n\nTo mitigate the risks associated with VNC, it is recommended to avoid exposing the service directly to the internet. Instead, it should be tunneled over SSH or placed behind a VPN. Additionally, the use of VNC implementations that support strong authentication and encryption, as well as disabling legacy security types, is advised. A long, unique password should be set and regularly updated, away from any default values. Access can be restricted by source address when possible, and monitoring for authentication attempts from unexpected sources and sessions beginning outside of normal working hours can help identify potential issues. However, it is important to note that a port query cannot confirm the service or its configuration, and VNC deployments on non-standard ports are not included in this count.",
  "summary": "5,102,346 Hosts on Port 5900: VNC and the Legacy Remote-Access Surface VNC predates most of the security assumptions that modern remote access takes for granted. Its original authentication scheme is weak by current standards, and its deployment patterns have not always kept up with the protocol's limitations. The problem and why it matters The Remote Framebuffer protocol, which VNC implements,…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}