Over 5 Million Hosts Found Running VNC on Port 5900, Raising Security Concerns

A ZoomEye query conducted on September 23, 2026, detected 5,102,346 internet-facing hosts with port 5900 open, the default port for VNC remote-access software. VNC, which implements the Remote Framebuffer protocol, has historically relied on weak authentication and is frequently deployed without encryption, leaving credentials and session data exposed on the network. The protocol is widely used in virtual machine consoles, kiosks, industrial equipment, and embedded devices where lightweight graphical access is needed. Security experts warn that while not all detected hosts are necessarily vulnerable, any VNC instance exposed directly to the internet without tunneling or strong authentication poses a significant risk. Recommended mitigations include routing VNC through SSH or a VPN, disabling legacy security types, using strong unique passwords, and monitoring for unusual login attempts.