CVE-2020-3992: VMware ESXi OpenSLP use-after-free allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated network-reachable remote code execution on a hypervisor, listed in CISA KEV with known ransomware use and very high EPSS.

What it is

OpenSLP as used in VMware ESXi contains a use-after-free flaw reachable over port 427 on the management network. An unauthenticated attacker with network access to that port can trigger the memory corruption and potentially execute code on the host. Because ESXi is a hypervisor, compromise affects every guest and workload on the machine.

Impact

Successful exploitation gives the attacker remote code execution on the ESXi host, which can lead to full control of the hypervisor and the virtual machines it runs. The CISA KEV entry notes known ransomware campaign use, so host takeover can feed directly into ransomware operations.

Attack surface

Reached over the network via the OpenSLP service on UDP/TCP port 427; the CVSS vector shows no privileges and no user interaction required. The description limits exposure to actors residing on the management network, so the port should not be internet-facing.

Exploitation

Listed in CISA KEV since 2021-11-03 with known ransomware campaign use, and EPSS 30-day probability is about 0.83 (99.7th percentile), indicating active exploitation is expected. Reference tags are vendor advisory, patch, third-party advisory and US Government resource; no public exploit code is described in the record.

What to do

• Apply the VMware ESXi updates referenced in VMSA-2020-0023 (ESXi 7.0 build 16850804 or later, and the ESXi670-202010401-SG / ESXi650-202010401-SG patches).
• Restrict access to port 427 so only trusted management hosts can reach it, and block it at network boundaries.
• Disable the OpenSLP service on ESXi hosts where it is not required.
• Segment the ESXi management network away from general user and workload networks.
• Verify remediation against the CISA KEV required action and track the 2022-05-03 due date for any remaining hosts.

Detection

• Monitor network traffic to and from port 427 on ESXi hosts for unexpected or external sources.
• Alert on ESXi host processes crashing or restarting, particularly the OpenSLP service (slpd).
• Review ESXi logs and management-network flow logs for anomalous connections preceding host instability.
• Hunt for signs of post-exploitation activity on ESXi hosts, such as unexpected shell access or new local accounts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.