Is CVE-2020-3992 (VMware ESXi OpenSLP Use-After-Free) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2020-3992 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution.

What “being exploited in the wild” means for this CVE

For a CVE question like this, the practical meaning is narrower than “is it dangerous?” It means there is credible evidence that attackers are using the flaw outside the lab, not just that it is theoretically exploitable. That changes urgency, because exposure now carries a known exploitation path and a higher likelihood of follow-on compromise.

The useful decision point is not whether the weakness exists, but whether your ESXi estate is reachable in the same conditions attackers need. For the CVE Program and NIST National Vulnerability Database, the record provides the canonical identifier and vulnerability context, while CISA’s KEV listing tells you the issue has crossed into active exploitation territory.

How attackers use VMware ESXi OpenSLP exposure

The technical concern here is not abstract code weakness, it is an attack path that can be exercised over the management network where port 427 is reachable. That means the flaw sits in a part of the environment where trust is often too broad, monitoring is thinner, and compromise can be operationally severe because ESXi is infrastructure rather than a single application host.

When a management-plane service has a use-after-free condition, an attacker who can reach it may be able to trigger remote code execution. For readers tracking attacker methods, the exploitation pattern is consistent with the sort of initial access and host compromise that quickly leads to privilege abuse, lateral movement, and recovery pressure on virtualization estates. The CWE Top 25 Guide is useful for understanding why use-after-free weaknesses are treated as high-risk root causes, not just isolated bugs.

Why CISA KEV status changes the response

CISA places a vulnerability in the KEV catalogue only when there is reliable evidence of active exploitation, so KEV status is a stronger operational signal than a generic advisory. CISA also flags when a vulnerability is known to be used in ransomware campaigns, which raises the cost of delay because the issue is already part of real intrusion playbooks.

That is why KEV-driven triage is different from ordinary backlog management. The right comparison is not “is this patched in the next cycle?” but “can this be removed from exposure now, before exploitation reaches my management plane?” The CISA Known Exploited Vulnerabilities Catalog and FIRST EPSS are complementary signals: KEV tells you exploitation is confirmed, while EPSS helps prioritise what is most likely to be targeted next.

Risk and Threat Considerations

The main risk is that management-network exposure turns a vulnerability into an infrastructure compromise, not just a server incident. If OpenSLP is reachable where it should not be, an attacker may move from reconnaissance to code execution on a platform that can host many workloads, amplifying blast radius and recovery complexity.

Failure mechanism: A reachable service on port 427 is abused through the use-after-free condition, allowing crafted traffic to destabilise memory handling and open the door to remote code execution on the ESXi host.

Impact: Successful exploitation can expose virtualization infrastructure to takeover, disrupt hosted systems, and create a fast path to ransomware deployment or broader internal compromise.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Active exploitation requires urgent remediation tracking and exception handling.
Recommendation — Prioritise and track remediation for KEV-listed hosts under SI-2.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV status makes vulnerability prioritisation and exposure validation central.
Recommendation — Use CIS-7 to identify, prioritise, and remediate exposed ESXi systems quickly.
NIST CSF 2.0	PR.PS-01 — Configuration Management	Mitigating this flaw depends on hardening and controlling exposed management services.
	ID.RA-01 — Asset Vulnerability Identification	The answer depends on confirming whether vulnerable ESXi assets are exposed.
Recommendation — Remove unnecessary service exposure and harden ESXi management-plane configuration. Identify affected ESXi assets and verify management-network exposure.
OWASP Non-Human Identity Top 10	NHI-06 — Insecure Cloud Deployment Configurations	The exploit path depends on insecurely exposed infrastructure services and trust boundaries.
Recommendation — Audit exposed management services and close unnecessary access paths.

Practitioner Guidance

What to prioritise: Treat internet-facing or management-network-reachable ESXi hosts as the first inspection set. If you cannot patch immediately, assume the KEV-listed condition is already part of attacker tooling and narrow exposure before you do anything else.

What to verify: Confirm whether OpenSLP is enabled, whether port 427 is reachable from any zone that should not contain administrative traffic, and whether the host appears in any vulnerability, asset, or exception register. If the asset is in scope, validate that your response path includes compromise checks, not only patching.

Practitioner takeaway: For a KEV-listed ESXi flaw, exposure control and compromise assessment matter as much as remediation timing, because active exploitation means the question is no longer hypothetical.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org