ZoomEye scan counts 5,102,346 reachable hosts on VNC's default port 5900

A five-million-host port scan

A query against the ZoomEye internet search engine returned 5,102,346 hosts where port 5900, the conventional first display port for the VNC remote-access protocol, was observed as open. The figure comes from an analysis published on dev.to on 25 September 2026, based on data collected with ZoomEye two days earlier. The query was deliberately narrow — a single port across all sub-types — and it still returned just over five million addresses.

The author is careful about what that number means. A port-based query reports addresses where 5900 answered a connection attempt. It does not verify that the listening service is actually VNC, and it says nothing about whether authentication is enabled or how it is configured. Deployments on non-standard ports are invisible to the query entirely.

A protocol that predates modern security assumptions

The count matters because of VNC's history. The protocol implements the Remote Framebuffer standard, documented in RFC 6143, and its original authentication was a challenge-response handshake built around a short key. According to the dev.to analysis, that key can be attacked offline if an attacker is able to capture the traffic. Later versions of the protocol introduced stronger security types, but support for older clients and servers means the weak options have never fully disappeared.

Encryption is a second gap: the analysis notes that VNC is frequently deployed without it, leaving both credentials and session content observable to anyone in a position to watch the network path.

Where VNC actually lives

None of this means five million systems are wide open. The analysis points out that VNC remains common wherever a graphical interface is needed but a full remote-desktop stack would be overkill: virtual machine consoles, kiosk systems, industrial equipment and embedded devices.

The security posture of those deployments varies enormously. A VNC server bound to localhost and reached through an SSH tunnel is a sound configuration. A server bound to a public interface and protected only by a short password is not. The ZoomEye count cannot distinguish between the two, so the number should be read as a measure of reachability rather than of vulnerability.

Practical hardening

The dev.to post closes with recommendations for anyone running VNC:

• Never expose a VNC server directly to the internet; tunnel it over SSH or place it behind a VPN.
• Use an implementation that supports strong authentication and encryption, and disable legacy security types.
• Set a long, unique password and replace any default credential.
• Restrict access by source address where the deployment allows it.
• Watch for authentication attempts from unexpected sources and for sessions beginning outside normal working hours.

Why it matters

A single query to a public search engine returned more than five million potentially reachable endpoints for a protocol whose original authentication was designed for a far less hostile network. Even if only a small fraction of those hosts is genuinely misconfigured, the absolute numbers make it likely that a substantial pool of weak targets exists — servers with short passwords, disabled authentication or plaintext sessions.

The figure is also a reminder that compatibility decisions in widely deployed protocols have very long shelf lives: weak security types persist because old clients still need to connect. And since the same query is available to anyone, the reconnaissance cost for attackers is essentially zero. For operators, the takeaway is blunt — port 5900 should not be reachable from the internet, and any deployment where it is deserves an immediate review.