Open Ports Statistics 2026: Exposed Services, Vulnerable Hosts & Exploited Flaws

Executive Benchmark: Open Ports Statistics for 2026

Methodology: What Counts as an Open Port?

“Open ports statistics” is used for four different measurements. Each answers a different question, comes from a different kind of source, and can be wrong in a different way.

Source confidence. Shadowserver publishes daily counts of unique IP addresses from its own scans. Its year in review describes more than 10,000 subscribing organizations and 201 national CSIRTs covering 175 countries, which makes it the broadest free public record. Censys is a commercial scanner; its counts describe what its scanners saw, which differs from what Shadowserver or any other scanner saw. CISA’s catalog is a floor of confirmed exploitation, not a census. Verizon’s DBIR is a contributed corpus of incidents, so it says how attackers got in, not how many doors exist. An IP address is not a device, an organization or a person.

Counting rules used here. Daily scan counts are noisy, so every Shadowserver figure in this report is a 7-day mean of daily unique IP counts, and the year-over-year comparison uses the same 7-day window one year earlier. A figure is never converted between units. Vendor-only data is labeled as such.

Open Ports Statistics: The Most Exposed Services in 2026

Shadowserver’s public dashboard reports unique IP addresses per day for dozens of services. The table gives the 7-day mean for 12 to 18 October 2026 and for the same window one year earlier (14 to 20 October 2025).

Source: Shadowserver dashboard, unique IP addresses per day, 7-day means calculated by ScanTitan. Latest single-day values on 18 October 2026: SSH 16,411,447, RDP 1,822,306, Telnet 611,712, SMB 686,545, FTP 4,517,074, MySQL 1,429,928, PostgreSQL 601,098.

Two things stand out. SSH is the most exposed management service by a wide margin: with 16.1 million addresses, it is about 9.4 times the RDP count. And almost every service is lower than a year ago, which is the opposite of the headline “attack surface keeps growing.” The only increase among the services tracked here is Elasticsearch, up 5.3% from a small base.

Remote Access Ports: RDP, SSH, Telnet, VNC and SMB

Remote access services get the most attention in open port statistics because a reachable login prompt invites password guessing and, for flawed versions, exploitation. In the 2026 DBIR, exploitation of vulnerabilities was the most common initial access vector at 31%, ahead of credential abuse at 13%, so a reachable port matters most when the software behind it is unpatched.

RDP: 1.7 million addresses, nearly half in Asia

Windows Remote Desktop was reachable on 1,724,327 IP addresses in the 7-day mean for 12 to 18 October 2026, down 20.6% from 2,172,970 a year earlier. By continent, Asia held 831,866 (48.2%), Europe 433,820 (25.2%), North America 376,221 (21.8%), South America 50,447, Africa 18,193 and Oceania 13,778.

SSH: 16.1 million addresses, spread across three continents

SSH was reachable on 16,123,849 addresses, down 11.0% from 18,117,400. Europe held 5,869,328 (36.4%), Asia 5,007,883 (31.1%) and North America 4,567,997 (28.3%). South America had 375,291, Oceania 165,900 and Africa 136,979. SSH is built to be exposed, so a reachable SSH port is a much weaker signal than a reachable RDP or database port. The question is key-only login, patch level and brute-force controls.

Telnet: halved, and concentrated in Asia and South America

Telnet, an unencrypted protocol that has no business facing the internet, was reachable on 611,029 addresses, down 52.6% from 1,288,346. Asia accounted for 326,333 (53.4%) and South America for 136,838 (22.4%), a much larger share for South America than for any other service in this table. Europe had 63,873, North America 53,171, Africa 27,227 and Oceania 3,588.

SMB: 675,172 addresses, and why port 445 matters

SMB was reachable on 675,172 addresses, down 15.7% from 801,130. Asia held 277,278 (41.1%), Europe 210,780 (31.2%) and North America 137,269 (20.3%). SMB is the protocol behind worm-style spread, which is why port 445 exposure is treated as high risk wherever it is reachable from the internet.

Source: Shadowserver dashboard, 12 to 18 October 2026. Continent is by IP geolocation, so it describes where the address is registered, not where the owner works.

Databases and Admin Services Reachable From the Internet

Databases and orchestration interfaces should rarely face the internet. Shadowserver’s 7-day means for 12 to 18 October 2026:

Source: Shadowserver dashboard. The count is addresses where the service answered, not addresses where it lacked a password.

Verizon’s 2026 DBIR includes a category of errors it describes as misconfiguration, such as a data store placed on the internet without access controls. That is the failure these databases represent when they are reachable and open. A reachable MongoDB or Redis port is not the same as an open database, because the count does not say whether authentication is on.

Do Non-Standard Ports Hide Services?

Closing a port on its default number or moving a service to an unusual one is sometimes offered as protection. Censys’s 2026 State of the Internet found that many services already run elsewhere: 96% of SOCKS proxies, 68% of HTTP(S) services and 34% of SSH services were on non-standard ports. For anyone who builds their view of exposure from a list of default ports, that means a large share of exposure is missing from the list.

Moving a port does not stop discovery. In a honeypot experiment published in November 2025, Censys reported that HTTP and HTTPS services received a first probe within a median of minutes, SSH servers were often probed within an hour, and a relocated SMB port (50445) was probed in under 7 hours. Censys found that port about 20 minutes earlier. The post does not publish the number of hosts or how long the experiment ran, so treat these as an illustration, not a benchmark.

Sources: Censys 2026 State of the Internet and Censys, who’s knocking on your door. Vendor-only.

Exposed Vulnerable Instances: Same Flaw, Different Counts

An exposure count becomes a risk count once a version check is added. But different scanners check at different times with different methods, so the same flaw produces different totals. MongoBleed (CVE-2025-14847) is a clean example.

Sources: Censys advisory, Shadowserver year in review and Shadowserver dashboard.

The 87,000 figure is Censys’s and the 74,854 figure is Shadowserver’s; they are not interchangeable and they were taken two days apart. The two published counts are also not the same measure as the October 2026 dashboard count, which covers all versions.

Other exposure counts from Censys

• AI and automation tools. Censys reported that AI-exposed hosts rose more than 63% from October 2025 to July 2026. More than 294,000 distinct IP addresses exposed at least one of 43 AI or LLM tools, up from about 183,000 in October 2025. Langflow exposure grew 169% and LiteLLM 97%.
• n8n. Censys counted 113,926 exposed n8n hosts, 76% of them in an affected version range.
• Industrial control systems. About 134,000 exposed ICS hosts in the early 2026 average, up about 4% from about 129,000 in 2024. About 70% sat on consumer and mobile networks. The United States held 32% (over 40,000 hosts); Turkey was second with fewer than 10,000. Europe’s share fell from 36.5% in 2024 to 32%.

Sources: Censys 2026 State of the Internet and Censys 2026 State of the Internet, ICS. Vendor-only.

Shadowserver’s year in review lists further dated exposure counts for specific products, including Cisco ASA and FTD devices (over 48,000 on 29 September 2025), WatchGuard Fireware (over 71,000 on 18 October 2025) and F5 BIG-IP (over 269,000 on 16 October 2025). Each is a snapshot on one date and measures exposure of a product, not exploitation of it.

Edge Devices and the CISA KEV Catalog

Edge devices (firewalls, VPN gateways, routers and similar boundary equipment) are the place where open ports and known exploited vulnerabilities meet. CISA’s KEV catalog lets us count how many exploited vulnerabilities sit in products from network-edge vendors.

CISA’s data feed (version 2026.10.16) lists 1,748 entries. 264 were added in 2026 so far, more than the 245 added in all of 2025, and 361 (20.7%) are marked as used in ransomware campaigns. ScanTitan counted entries by vendor name in the feed.

Source: CISA KEV feed, version 2026.10.16, counted by ScanTitan. Microsoft, Apple, Adobe and Google entries mostly cover desktop and browser software, not network edge equipment.

To estimate the edge share, ScanTitan grouped 21 vendors that mostly make boundary equipment: Cisco, Fortinet, Palo Alto Networks, Ivanti, Citrix, SonicWall, F5, Juniper, Check Point, Zyxel, D-Link (including one D-Link and TRENDnet entry), TP-Link, MikroTik, NETGEAR, Ubiquiti, WatchGuard, Barracuda, Sophos, Pulse Secure, Array Networks and DrayTek. These vendors hold 335 of 1,748 entries (19.2%).

Source: CISA KEV feed, version 2026.10.16, counted by ScanTitan. This counts entries from selected vendors, not entries confirmed to be edge devices, because some vendors also sell software that does not sit on the boundary.

By vendor within this selection: Cisco 101, Ivanti 36, Fortinet 32, Citrix 27, D-Link 26, SonicWall 19, Palo Alto Networks 16, Zyxel 13, F5 8, Juniper 8, NETGEAR 8, Sophos 7, TP-Link 6 and MikroTik 5.

The edge share of new additions is higher than its share of the whole catalog (22.0% in 2025 and 23.1% in 2026 against 19.2%). That points toward more of the newly exploited flaws sitting in boundary equipment, though the selection method, not just the trend, drives the exact percentages.

VulnCheck: end-of-life devices and the KEV gap

VulnCheck’s 2026 State of Exploitation report on the network edge (vendor-only) found that 42.5% of vulnerabilities exploited in 2025 affected devices that are end of life or likely end of life. Consumer routers and globally distributed networking products accounted for 56% of exploited edge vulnerabilities. Only 23.7% of the identified vulnerabilities appear in CISA’s KEV catalog, and 65% of botnet-exploited vulnerabilities affected end-of-life or likely end-of-life products. Source: VulnCheck.

The last two figures matter together: a count from the KEV catalog, including the one above, understates edge exploitation because most of what VulnCheck found never reached the catalog.

What the 2026 DBIR says about VPNs and edge devices

• Initial-access brokers. Of 876 initial-access-broker offers over four years, 44% were for VPN access, followed closely by remote desktop access (RDP, RDPweb and VNC).
• Small business ransomware. Among small and medium business ransomware victims, 38% were victimized through compromised credentials and 29% through unpatched vulnerabilities in edge devices. About 96% of ransomware victims are small and medium businesses.
• System Intrusion pattern. VPN as a vector stays around 16%, and the two leading initial access vectors, use of stolen credentials and exploitation of vulnerabilities, are both 39%.
• End-of-life routers. The DBIR notes end-of-life internet-facing cellular routers in utilities and mining, with default passwords on exposed management interfaces or unpatched vulnerabilities.

Source: Verizon 2026 DBIR, pages 34, 40, 45 and 98. The 2026 DBIR does not publish an edge-device-specific remediation time, so no 2026 figure is given here.

CISA’s two directives

• BOD 26-02 (5 February 2026) covers end-of-support edge devices at federal agencies, defined as devices on the boundary of an agency network and accessible from the public internet. It requires immediate updates, an inventory within 3 months, decommissioning of listed end-of-support devices within 12 months, all identified ones within 18 months, and continuous discovery with decommissioning by the support end date within 24 months. Source: CISA BOD 26-02.
• BOD 26-04 (10 June 2026) replaces BOD 19-02 and BOD 22-01 with risk-based prioritization using four criteria: asset exposure, KEV status, exploit automation and technical impact. A 3-day deadline appears as an example case, and the directive applies to federal civilian executive branch agencies only. It is not a general 3-day rule for edge devices. Source: CISA BOD 26-04.

Time to Exploit vs Time to Probe vs Time to Patch

Three clocks run at once, and each uses a different unit.

Sources: Censys, Google Cloud, M-Trends 2026 and the Verizon 2026 DBIR Executive Summary.

Mandiant’s negative figure means exploitation often began before a patch was available. In the DBIR, only 26% of KEV vulnerabilities were fully remediated, down from 38% in the prior dataset, with a median of 43 days. Exposure is found in hours, exploitation can come before a fix, and remediation takes weeks. The three numbers measure different events and cannot be subtracted.

Open Ports Statistics by Region

Regional splits are available for the Shadowserver service counts and the Censys ICS count. They answer where addresses are registered, not where risk is highest.

Sources: Shadowserver dashboard and Censys. Percentages for Shadowserver are calculated by ScanTitan from the continent counts in the 7-day mean.

Asia leads three of the four remote access services, and Europe’s share of exposed ICS hosts shrank from 36.5% to 32% between 2024 and early 2026. Larger populations of addresses explain part of this, so a high regional count is not evidence of weaker practice.

Open Ports Statistics Commonly Misquoted

What the Numbers Mean for a Lean Team

A small security team cannot chase 16 million addresses, but the numbers point to a short list.

1. Know what your own perimeter exposes. The only count that matters to you is yours. Start from a list of every internet-facing address and every port that answers, with the service identified by what responds, not by the port number. ScanTitan’s guides to internet-exposed services and open ports risk assessment cover how to build that list.
2. Treat RDP, SMB, Telnet and databases as findings, not features. None needs to face the internet. VPN-fronted access or an allow list is the usual fix. A port exposure fix generator helps turn a finding into a firewall change.
3. Put edge devices first on the patch list. Boundary devices carry a fifth of the KEV catalog by this count, brokers sell VPN access, and many exploited edge flaws sit in products that no longer get updates. Replace end-of-life devices instead of waiting for a patch that will not come.
4. Prioritize by exploitation, not by volume. Use KEV status and exposure together, as CISA’s BOD 26-04 does. A CVE priority checker shows whether a flaw is in KEV.
5. Re-scan on a schedule. Exposure changes with every deployment. Continuous network exposure monitoring and an attack surface management process catch new services before a scanner on the internet does. Raw scan output is easier to act on once it is explained, for example with an Nmap output explainer.

For the vulnerabilities that sit behind web-facing services, see ScanTitan’s web application attack statistics, and for the dependency side, the software supply chain attack statistics.

How We Compiled and Verified These Statistics

• Used: Shadowserver’s public dashboard and year in review, Censys reports and advisories, the CISA KEV data feed and directives, Verizon’s 2026 DBIR (full report and executive summary), Mandiant M-Trends 2026 and VulnCheck’s 2026 network edge report. Censys and VulnCheck figures are labeled vendor-only.
• Method: Shadowserver counts are 7-day means of daily unique IP addresses, calculated by ScanTitan from the dashboard’s data for 12 to 18 October 2026 and 14 to 20 October 2025. KEV counts come from feed version 2026.10.16, counted by vendor name and date added.
• Excluded: secondary summaries, figures that could not be traced to a primary source, and unsupported exposure totals quoted from search-engine snapshots. Shadowserver’s scale claims for IPv4 and IPv6 address counts and VulnCheck figures that do not appear on its public pages were also left out.
• Refresh: Reviewed every 90 days. Dashboard counts change daily and lag the current date by about two days; KEV counts change monthly; Verizon, Censys and VulnCheck update on their annual cycles.

How to cite this research. ScanTitan, “Open Ports Statistics 2026: Exposed Services, Vulnerable Hosts & Exploited Flaws,” 20 October 2026. For single figures, cite the primary source beside each number; cite the 7-day means and KEV vendor counts to this page with the date range or catalog version.

Primary Sources

• Shadowserver dashboard, combined statistics and Shadowserver 2025 year in review
• Shadowserver network reporting
• Censys 2026 State of the Internet and ICS edition
• Censys, who’s knocking on your door and Censys advisory CVE-2025-14847
• CISA Known Exploited Vulnerabilities catalog data feed
• CISA BOD 26-02, end-of-support edge devices and BOD 26-04, risk-based prioritization
• Verizon 2026 Data Breach Investigations Report and Executive Summary
• Google Cloud, M-Trends 2026
• VulnCheck, 2026 network edge device report

Frequently Asked Questions