---
id: "CVE-2020-3992"
kind: "vulnerability"
aliases: ["CVE-2020-3992"]
title: "VMware ESXi: VMware ESXi OpenSLP Use-After-Free Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.83015
exploited: true
status: "open"
category: "vendor"
products: [{"name": "VMware ESXi", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["esxi", "exploited", "on-prem-virtualization", "ransomware", "self-hosted", "vendor", "vmware"]
not_affected_if: ["managed-hosting", "patched-build", "port-427-blocked"]
published_at: "2020-10-20T17:15:12+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T20:29:27+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-3992", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-3992", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3992", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# VMware ESXi: VMware ESXi OpenSLP Use-After-Free Vulnerability

VMware ESXi's OpenSLP service has a use-after-free bug that lets an attacker on the management network reach port 427 and run code on the host. CISA lists it as actively exploited, with ransomware use noted in its catalog.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VMware ESXi affected ? fixed ?

## How to check

Confirm the ESXi build against the fixed builds in the advisory: ESXi 7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG.
Check whether TCP/UDP port 427 is reachable from anything other than trusted management hosts.
How to read the installed build from the host is unknown from the sources.

## Fix

Patch ESXi to the fixed build for your release line (ESXi_7.0.1-0.0.16850804, ESXi670-202010401-SG, or ESXi650-202010401-SG).
If patching is not immediate, the sources do not say whether disabling the SLP service is an accepted mitigation; unknown.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-3992
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-3992
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-3992

## From the sources

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_