ZoomEye query counts 72,819 Samba servers reachable from the public internet

What the count shows

Samba is the open-source implementation of SMB, the file- and print-sharing protocol, on Unix and Linux systems, and in many organisations it is the bridge that lets Windows desktops work with Linux file servers. According to an analysis published on dev.to, a ZoomEye query using the application fingerprint app="Samba" returned 72,819 services answering from the public internet, with the data collected on 24 September 2026 (UTC).

The same collection run counted 1,870,478 reachable services on port 2049, the standard NFS port. The dev.to post stresses that the two figures measure different things: the Samba number matches responses against a fingerprint for a specific implementation, while the port number only confirms that something is listening there, whatever software sits behind it. Neither is a tally of vulnerabilities. An earlier pass in the same series, using different query forms, recorded only 110 NFS and 1,771 SMB results, which the author offers as a reminder that such censuses shift sharply depending on how the question is phrased.

How the exposure happens

In a normal corporate setup, SMB traffic between Windows clients and a Linux file server stays on a private network. A service that responds to an SMB fingerprint from the open internet therefore points to one of a few situations, the post argues: a file server deliberately placed in a DMZ, a firewall or routing rule that admits the port from wide source ranges, a hosting environment where the private network is really shared tenancy, or a colocated machine whose operators assumed nobody would scan its address range. The author flags that last group as the one worth auditing first, because assuming an address range attracts no attention is not a security control.

Why file sharing resists cleanup

The structural difficulty is who file shares serve. A management console can sit behind a VPN because administrators will accept one extra step; a share generally cannot, since its users are effectively the entire organisation, from office desktops and home laptops to partner document exchanges and business applications whose integration method is reading and writing files. Locking a share down to a controlled network means reorganising how work gets done, which is an organisational project rather than a tweak to a firewall.

Protocol details compound the risk. SMB negotiates dialects, authenticates through NTLM or Kerberos, supports signing and enforces per-share permissions. Historically, the significant attacks against it have concentrated on negotiation and authentication, and older dialects carried authentication designs that current configurations reject outright. An up-to-date Samba release with signing enforced and SMB1 switched off presents a far smaller target than a server that keeps SMB1 alive for one legacy device.

The post also explains why file servers often drop out of vulnerability programmes: a scan produces a long list of dialect, signing and anonymous-access findings, most of which cannot be fixed without breaking access, so the whole category gets abandoned. The recommended alternative is triage, separating findings the server team can address through configuration changes from those that need an access-restructuring project, and tackling internet reachability first as the item that removes the most exposure for the least work.

Checks the post recommends

The listed steps are: determine whether any SMB or NFS service answers from outside the organisation's controlled networks, and assume a positive result is a routing mistake unless someone can show it was deliberate; confirm SMB1 is disabled and signing is required on every server, including those serving only legacy clients; audit anonymous and guest access on each share, the issue most often flagged once reachability is ruled out; reconcile share permissions against the identities that can actually reach them; and include file-server service accounts in credential rotation, since they are frequently long-lived and skipped.

Why it matters

The 72,819 figure is a census rather than a breach report, but it offers an outside-in view of an estate that internal inventories routinely miss, because shares tend to be created ad hoc and named unpredictably. The same fingerprint query is open to anyone through ZoomEye's public interface, so a team can see its exposure exactly as an outside observer would. Reachability is also the highest-leverage item on the list: in most cases it is a configuration fix, and it removes an entire class of internet-facing risk in a single change.