Open Port Vulnerabilities: A Complete List and Security Guide

Open ports are what make networks function. They let web servers accept traffic, remote administrators connect, and business applications communicate. They are also the first thing a threat actor scans for.

Attackers use automated tools to survey the internet for exposed services. When they find a port running an unpatched service, a misconfigured protocol, or a weak credential, they have a direct path deeper into the network. According to the Verizon 2026 Data Breach Investigations Report, exploitation of vulnerabilities as an initial access vector rose 55% year over year to account for 31% of breaches.

Open ports are essential to operations. The work is understanding which ones carry risk, what attacks they enable, and how to control the exposure. This guide covers the most vulnerable ports in common use, the attack techniques targeting them, and steps to reduce your attack surface.

What are open ports?

A port is a virtual communication endpoint that routes network traffic to the appropriate service or application on a device. Every networked device has up to 65,535 TCP ports and 65,535 UDP ports, each identified by a number. Administrators control which ports accept incoming connections, opening only those needed for legitimate services and closing or filtering the rest.

Port 80 handles HTTP web traffic. Port 443 handles HTTPS. Port 22 handles SSH connections. When a service is running and a port is open, any device on the network, or on the internet if the port is externally exposed, can attempt to connect.

Types of ports

TCP and UDP are the two transport protocols that ports use. Understanding the difference matters for assessing and controlling network exposure.

TCP

TCP is connection-oriented. It establishes a verified connection before transferring data, includes built-in error detection and retransmission, and guarantees delivery. Most services requiring reliability, such as web browsing, file transfer, and remote access, run over TCP.

UDP

UDP is connectionless. It sends data without confirming delivery, reducing overhead and improving speed. Services prioritizing performance over guaranteed delivery, such as DNS lookups, streaming, and VoIP, commonly use UDP.

Types of port states

TCP and UDP ports exist in one of three states:

• Open: The port accepts connection requests and a service is actively listening.
• Closed: The port is reachable, but no service is running; the OS still replies with a TCP RST (reset) packet, so the attempt gets an explicit rejection rather than silence.
• Filtered: A firewall blocks connection attempts, so no response reaches the requester.

A closed port is a known quantity. A filtered port reveals nothing to an attacker. The risk lies in an open port with the wrong service behind it.

Why open ports are a security risk

An open port is a direct communication channel from the internet to a service running on your infrastructure. The risk is measurable, growing, and tied directly to financial outcomes.

Attackers scan for open ports continuously

Automated scanning tools survey the entire IPv4 address space within hours. Platforms like Shodan and Censys continuously index exposed services, meaning that any port opened without a corresponding firewall restriction can be discovered within minutes. Attackers don't need to target your organization specifically. They scan at scale, identify services running vulnerable versions, and attack any IP that responds. A misconfigured port that shows up in your next scheduled audit may have already faced thousands of unauthorized connection attempts.

Port exploitation is on the rise

Attacks targeting network services are climbing. According to the Netwrix Cybersecurity Trends Report 2025, 28% of organizations experienced a targeted attack on their on-premises infrastructure in the past year, up from 19% in 2023. More broadly, 51% confirmed a security incident that required a dedicated response from security teams in the past 12 months. Reducing your attack surface starts with controlling which services are reachable and ensuring each one is patched and correctly configured.

Weak port posture directly predicts breach risk

Research from Bitsight found that organizations with a poor open port grade are more than twice as likely to experience a data breach as those with strong port controls. The financial exposure is real. The Netwrix Cybersecurity Trends Report 2025 found that 75% of organizations reported financial damage from security attacks, with 13% estimating losses of $200,000 or more.

Open port vulnerability case studies

Real-world incidents show what happens when open ports with unpatched services face the internet without adequate controls. Two attacks on ports 445 and 3389 remain among the most referenced in network security.

WannaCry: SMB port 445 and the cost of one unpatched vulnerability

The WannaCry ransomware attack in May 2017 remains one of the most consequential examples of open port exploitation. Attackers used the EternalBlue exploit to target SMBv1 on port 445, spreading ransomware to over 300,000 systems across 150 countries without requiring user interaction. The damage was possible because exposed SMB ports were reachable from the internet and the underlying protocol carried an unpatched critical vulnerability.

RDP Pipe Plumbing: Man-in-the-middle over port 3389

RDP Pipe Plumbing exploits Windows named pipes over port 3389. Attackers create fake pipe server instances that match legitimate names, then intercept RDP communications to capture data, including clipboard contents and file transfers. This man-in-the-middle technique requires only an accessible RDP port to execute.

Vulnerable open ports and their associated risks

The following ports consistently appear in attack data as high-risk exposure points. Each covers what the port does, why it’s vulnerable, and the specific attack methods that target it.

Port 21 (FTP)

The File Transfer Protocol uses port 21 for control commands and port 20 for data transfers. FTP transmits all data, including credentials, in cleartext, with no built-in encryption or server verification. It’s considered obsolete, and organizations still running FTP should migrate to SFTP or FTPS.

• Credential interception: FTP transmits usernames and passwords in plaintext. Any attacker with access to network traffic can capture credentials without active exploitation.
• Brute-force attacks: Automated tools systematically attempt username and password combinations against the FTP service until valid credentials are found.
• Anonymous authentication abuse: Many FTP servers accept "anonymous" as both the username and password by default, granting unauthenticated access to hosted files.
• Directory traversal: Attackers submit crafted file-path requests to navigate outside the FTP root directory and access files on the underlying system.

Port 22 (SSH)

Secure Shell uses port 22 for encrypted remote access and file transfer, supporting secure remote access to servers and network devices. SSH replaced Telnet as the standard for remote system management. The encryption protects data in transit, but improperly configured SSH creates two well-documented attack surfaces.

• Brute-force attacks: Open SSH ports with password authentication enabled are a persistent target. Automated tools execute thousands of login attempts per minute against port 22.
• SSH key theft: A stolen or improperly stored private key grants full access to any system that trusts the corresponding public key, with no password required.
• SSH tunneling abuse: Attackers with initial access use SSH port forwarding to create encrypted tunnels that bypass firewall controls, enabling data exfiltration or lateral movement to internal systems.

Port 23 (Telnet)

Telnet operates on TCP port 23 and provides command-line access to remote devices, including routers, switches, and servers. Like FTP, Telnet transmits all data, including credentials, in cleartext. SSH superseded Telnet as a secure alternative, and any Telnet service on an internet-facing system represents an entirely avoidable risk.

• Credential interception: Telnet transmits usernames and passwords in plaintext. Any attacker positioned between the client and server captures credentials without active exploitation.
• Brute-force attacks: Automated tools target open Telnet ports with high-volume login attempts, particularly against routers and switches that retain default credentials.

Port 25 (SMTP)

Port 25 handles Simple Mail Transfer Protocol, the standard for server-to-server email relay. SMTP predates modern security requirements, and without proper configuration, it creates three well-documented exploitable conditions.

• Email spoofing: Attackers forge sender headers to make messages appear to originate from trusted domains, enabling phishing campaigns that bypass basic sender-reputation filters.
• Open relay abuse: An unprotected SMTP server with no relay restrictions delivers email on behalf of any sender, making it a platform for high-volume spam and malware distribution.
• STARTTLS downgrade attacks: When a mail server doesn’t enforce STARTTLS, attackers intercept the connection negotiation and force an unencrypted session, exposing email content and credentials in transit.

Port 53 (DNS)

Port 53 handles Domain Name System queries, translating domain names into IP addresses for internet traffic. DNS uses UDP for standard queries and TCP for zone transfers. Because nearly every network operation depends on DNS, it’s a high-value attack target and a protocol that perimeter controls frequently leave unrestricted.

• DNS amplification attacks: Attackers send small queries with a spoofed source IP to open resolvers. The resolver returns much larger responses to the victim, generating disproportionate traffic volumes in a DDoS attack.
• DNS tunneling: Attackers encode data payloads inside DNS queries and responses to exfiltrate information or maintain command-and-control communication through firewalls that permit DNS traffic.
• DNS cache poisoning: Attackers inject forged DNS responses into a resolver's cache, redirecting users from legitimate domains to attacker-controlled addresses without their knowledge. Monitoring DNS records for unauthorized changes is a key control against this technique.

Ports 137, 139, and 445 (NetBIOS and SMB)

Ports 137 and 139 handle NetBIOS over TCP. Port 445 handles Server Message Block (SMB), the Windows protocol for file sharing, print sharing, and network communication. Disable SMBv1 on all systems. SMBv2 and SMBv3 with encryption enabled are the current standard.

• EternalBlue exploit: This attack targets a critical vulnerability in SMBv1, enabling remote code execution without authentication or user interaction. EternalBlue powered the WannaCry and NotPetya attacks and remains in active use.
• NTLM relay attacks: Attackers intercept NTLM authentication requests over SMB and relay them to other systems on the network, authenticating as the legitimate user without recovering the password.
• Brute-force credential attacks: Automated tools target exposed SMB ports with high-volume login attempts, particularly against systems running with weak or default credentials.

Ports 80, 443, 8080, and 8443 (HTTP and HTTPS)

Web ports must remain open and externally accessible for most organizations to function, making them a consistent target. HTTP (80) and its alternate (8080) transmit data in cleartext. HTTPS (443, 8443) encrypts the transport layer but doesn’t protect against application-layer attacks.

• SQL injection: Attackers insert malicious SQL statements into web application input fields to manipulate the underlying database, extract sensitive data, or modify records.
• Cross-site scripting (XSS): Attackers inject malicious scripts into web pages that execute in users' browsers, enabling session hijacking and credential theft.
• Cross-site request forgery (CSRF): Attackers exploit an authenticated user's active session to submit unauthorized requests to a web application, triggering actions the user never initiated.
• DDoS attacks: Attackers flood web ports with traffic to exhaust server resources and take the application offline for legitimate users.

Ports 1433, 1434, and 3306 (database ports)

Port 1433 is the default for Microsoft SQL Server, port 1434 for the SQL Server Browser service, and port 3306 for MySQL. These ports provide direct access to database services. Databases should sit behind application layers and remain inaccessible from the internet. Any exposed database port results directly from misconfiguration.

• Brute-force and credential attacks: Exposed database ports accept direct login attempts. Automated tools target default credentials and weak passwords on SQL Server and MySQL instances.
• Direct SQL injection: Attackers connected directly to an exposed database port execute SQL commands without going through the application layer, bypassing web application firewall controls entirely.
• Exploitation of known service vulnerabilities: Unpatched SQL Server and MySQL instances carry CVEs that attackers exploit once a database port is reachable, enabling remote code execution or privilege escalation on the database host.

Port 3389 (RDP)

Port 3389 handles the Remote Desktop Protocol and provides graphical remote access to Windows systems. RDP is heavily used in enterprise environments for remote administration, helpdesk support, and virtual desktop infrastructure. That ubiquity makes it one of the most targeted ports on the internet.

• BlueKeep (CVE-2019-0708): A wormable vulnerability in Windows 7 and Windows Server 2008 R2 that allows remote code execution without authentication or user interaction. Attackers can automatically spread malware across networks by targeting the exposed port 3389.
• CVE-2024-38077: A critical RCE vulnerability (CVSS 9.8) in the Windows Remote Desktop Licensing Service. Unauthenticated attackers execute arbitrary code by sending a specially crafted network packet, with no user interaction required. Organizations running this service should treat it as an immediate patching priority.
• Brute-force and credential-stuffing attacks: Open RDP ports face continuous automated login attempts. Credential stuffing replays username-password pairs from prior breaches directly against exposed RDP services.

Port 5900 (VNC)

Port 5900 is the default for Virtual Network Computing, a remote desktop sharing system common in IT support and administration environments. VNC provides graphical access similar to RDP, but carries distinct risks tied to weak authentication defaults and inconsistent encryption across implementations.

• Cleartext session interception: Older VNC implementations transmit session data in plain text. Attackers who capture network traffic can steal the full graphical session, including keystrokes and screen contents.
• Brute-force attacks: Many VNC deployments use a single shared password and lack an account lockout policy, making port 5900 a straightforward target for automated credential enumeration.
• Default credential exploitation: Attackers routinely scan for open port 5900 and attempt access using commonly known default VNC passwords. Systems deployed without changing the default password are accessible to anyone who finds the open port.

Mapping port attacks to MITRE ATT&CK

The techniques above map to established ATT&CK entries security teams already track:

• External reconnaissance and internal discovery: Attackers scanning the internet for open ports, the behavior driving Shodan and Censys indexing, fall under Active Scanning (T1595). Once inside a network, scanning for other reachable services to move laterally is a separate technique, Network Service Discovery (T1046).
• Initial access and exploitation: EternalBlue and similar unpatched-service attacks fall under Exploitation of Remote Services (T1210).
• Lateral movement: RDP, SSH, and SMB logins used to move between systems with valid or stolen credentials fall under Remote Services (T1021).
• Credential access: Brute-force and credential-stuffing attacks against SSH, RDP, VNC, and database ports are Brute Force (T1110).
• Command and control and evasion: Attackers using an open port to redirect or relay traffic through a compromised host fall under Proxy (T1090), the technique behind the "redirects" case you flagged. DNS tunneling is Protocol Tunneling (T1572).
• Man-in-the-middle: NTLM relay and RDP Pipe Plumbing fall under Adversary-in-the-Middle (T1557).

How to scan for open ports

Before securing open ports, you need to know which ones are exposed. Three main approaches provide this visibility:

Command-line tools

The netstat command, available on Windows and Linux, shows active connections and listening ports on a local system. Running netstat -an displays all connections with their associated addresses. For network-wide visibility, Nmap is the standard tool. The command nmap -sV <target> scans the target IP or range, identifies open ports, and detects the service version on each, which is critical for identifying outdated software.

Port scanners

Dedicated port scanning tools automate probing across network segments. They send connection requests, classify responses as open, closed, or filtered, and produce a service inventory. Many integrate with vulnerability databases to flag known risks for discovered services.

Vulnerability scanners

Vulnerability scanning tools combine port discovery with CVE database matching. They identify open ports, detect the service running on each port, and cross-reference the service version against known vulnerabilities. The output includes risk ratings and remediation guidance. Regularly scheduled scans, rather than point-in-time assessments, provide ongoing visibility as configurations change.

How to secure open ports

Reducing open port risk takes more than a single control. The steps below address the most common sources of exposure, from outdated protocols and unpatched services to gaps in monitoring and access management.

Use encrypted protocols

Replace cleartext protocols with encrypted equivalents wherever possible. FTP moves to SFTP or FTPS. Telnet moves to SSH. HTTP redirects to HTTPS. Any service transmitting credentials over an unencrypted connection carries an avoidable risk. The network security best practices governing this decision are well established: where an encrypted version of the protocol exists, use it.

Apply patches and updates regularly

Unpatched services are the most direct path from an open port to a compromised system. The EternalBlue exploit that powered WannaCry targeted a vulnerability Microsoft had already patched. Microsoft patched CVE-2024-38077 before it was widely exploited. A consistent patching cadence, applied promptly after release, eliminates most known vulnerabilities before attackers can act on them.

Use port scanning tools

Treat port scanning as a recurring operational task. Scheduled scans with tools like Nmap identify new services that appear on the network between audits. Any open port not mapped to a known, authorized service is a finding that requires immediate investigation. Pair external scans with internal scans to capture both internet-facing exposure and internally accessible services.

Restrict access with firewalls and ACLs

Limit which source IPs and network segments can reach a given port at the host firewall, network firewall, and switch ACL layers. A database port that only the application server needs should be reachable only from that server's IP, not from the entire subnet.

Monitor service configuration changes

Configuration changes to servers, firewalls, and network devices frequently introduce new port exposures: a temporary firewall rule that is never removed, a service enabled during troubleshooting that remains running, a default configuration deployed without hardening.

Netwrix Change Tracker monitors infrastructure for configuration drift, tracking changes to firewall rules, service configurations, and system settings in real time. It records every change with its before-and-after state, attributes it to a specific account and source system, and triggers alerts when configurations deviate from approved baselines. Security teams know what changed, when, and who made the change, rather than discovering new exposures only during periodic scans.

Deploy IDS and IPS

Intrusion Detection Systems monitor network traffic for signs of suspicious activity targeting open ports. Intrusion Prevention Systems go further by actively blocking detected attack patterns. Both defend against common port-based exploits, including SQL injection, DDoS floods, and brute-force login attempts. IDS and IPS complement patching and port closure by adding a detection and blocking layer between an open port and a successful intrusion.

Implement SSH key authentication

SSH keys provide stronger authentication than passwords for services on port 22. Private keys are computationally infeasible to brute-force. Implementing key-based authentication and disabling password-based login on SSH eliminates the largest category of SSH attacks. Protect private keys with a passphrase, store them securely, and rotate them when employees with access leave the organization.

Conduct penetration tests and vulnerability assessments

Penetration testing and vulnerability assessments address open-port risk from different angles. A vulnerability assessment runs automated scans to identify known weaknesses across infrastructure and produces a prioritized remediation list.

A penetration test has a security professional simulate a real attack, actively exploiting vulnerabilities through open ports to show how far an attacker could advance. Together, they provide automated breadth coverage plus manual validation of the highest-risk paths.

Open port security best practices

Securing open ports requires more than patching and scanning. The following operational practices form the baseline for consistent port security.

• Assess your external attack surface regularly: Every open port visible from the internet is a potential initial access point. The SANS 2025 Attack Surface Management Survey identified unknown assets and services as a top challenge for security teams, reinforcing the need for continuous, not periodic, discovery. Close or restrict any port without an active, documented business justification.
• Apply critical patches immediately: The window between vulnerability disclosure and active exploitation has shortened. High-severity CVEs targeting services on open ports, such as the 9.8-rated CVE-2024-38077 affecting RDP, receive public proof-of-concept code within days of disclosure. Critical patch releases for services on open ports require immediate action.
• Map every open port to an owner: Each open port should have a documented owner responsible for the service behind it. Deprecated services with lingering open ports are among the most common sources of unmanaged exposure. When you decommission a service, include closing its associated port in the decommissioning checklist.
• Monitor for configuration drift: Changes in port exposure between scheduled scans. A patching script, a developer's test environment, or a misconfigured security group can open a new port with no formal change request. Continuous file integrity and configuration monitoring tools detect these changes in near real time, preventing undetected exposure from persisting until the next audit cycle.
• Apply the principle of least privilege to network access: Services should be accessible only from the IP addresses and network segments that require them. A database port that only the application server needs to reach should be accessible only from that server's IP address. This containment limits the damage if an attacker reaches the network through another vector.

How Netwrix helps you monitor open port risk

Open port security fails when configurations drift without detection. A firewall rule gets added for a temporary project and never removed. A service gets enabled during troubleshooting and stays running. A default configuration deploys without hardening. Each creates an exposure point that manual audits miss between cycles.

Real-time configuration change detection

Netwrix Change Tracker continuously monitors servers, network devices, and firewall configurations. When a change occurs, such as a new service starting, a firewall rule being modified, or a port being opened, it captures the before-and-after state, records the time and source, and triggers an alert. Security teams receive immediate notification when configurations deviate from the approved baseline, closing the gap left by periodic scanning.

Automated configuration drift alerts

Netwrix Change Tracker compares current infrastructure state against approved configuration baselines and flags deviations. For open port management, any service or port configuration that departs from the authorized state generates an actionable alert with specific change details, enabling teams to investigate and remediate before an attacker discovers the exposure.

Compliance-ready reporting

Demonstrating compliance on open port controls requires more than having the controls in place. Auditors need documented evidence that those controls are consistently applied. Netwrix Auditor provides pre-built compliance report mappings for PCI DSS, NIST 800-53, HIPAA, and CMMC, covering change control and access monitoring requirements for network-facing infrastructure. Windows audit policy settings establish the logging baseline; Netwrix Auditor structures that log data into audit-ready reports documenting who changed what, when, and from which system, providing the evidence trail compliance reviews require.

Request a demo to see how Netwrix helps you detect configuration changes across your open port infrastructure before attackers do.