CVE-2020-3992 is an openslp use-after-free vulnerability in VMware ESXi. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution.
What Makes This Vulnerability Dangerous
VMware ESXi OpenSLP is exposed through a management-plane service, so a use-after-free in that component is especially serious because it can move from an apparently routine network service flaw to remote code execution on the host. When the vulnerable service is reachable, the issue is not just instability, but potential control of the hypervisor itself.
The danger is amplified by the role ESXi plays in virtualised environments. Compromise of the host can affect multiple workloads at once, which turns a single weakness into a broader infrastructure security problem. For background on the root weakness class, see the CWE Top 25 Guide.
How Organisations Confirm Exposure
Exposure assessment starts with asset inventory, because only systems running the affected ESXi service path matter. Teams should confirm whether OpenSLP is present, whether the management network can reach port 427, and whether the host is reachable from segments that should never see management services.
For this kind of CVE, vendor advisories and vulnerability records are the authoritative places to verify affected versions and patch status. The published record in the NIST National Vulnerability Database and the CVE Program should be used alongside VMware guidance rather than relying on third-party summaries.
Remediation and Compensating Controls
The ideal fix is to apply the vendor remediation for the exact ESXi build in question, but operational reality often means some hosts cannot be patched immediately. In that case, the most important compensating control is to reduce or eliminate exposure of the vulnerable management service, especially where port 427 is reachable from broader internal networks.
That usually means tightening management-network segmentation, limiting access to trusted administrative sources, and watching any exception path very closely. A vulnerability-management workflow helps here because it ties asset scope, prioritisation and verification together instead of treating patching as a one-time task. The Vulnerability Management Guide is a useful reference for that lifecycle view.
Detection and Post-Compromise Review
Because this flaw can lead to remote code execution, detection should focus on both exploitation attempts and signs of follow-on activity after a host compromise. Unusual management-plane traffic, unexpected process behaviour on ESXi, and configuration changes that were not approved are all relevant signals.
If there is any suspicion of exploitation, post-incident review should assume the host may have been used as an initial foothold for broader movement. That means reviewing adjacent administrative accounts, connected management systems, and any evidence that the attacker touched storage, virtual machines, or service credentials. For a broader view of real-world exploitation patterns and identity-driven follow-on abuse, the State of NHI & AI Agent Breach Report is relevant to the compromise and lateral-movement patterns that often follow initial access.
Risk and Threat Considerations
This CVE is dangerous because it affects a management-facing service on an ESXi host, and successful exploitation can hand an attacker code execution in a high-value environment. If the vulnerable service is reachable from the management network, the attacker does not need a user-facing application path, just a way to speak to the service.
Failure mechanism: A use-after-free can corrupt process memory when the service handles crafted input, which can be converted into arbitrary code execution on the host.
Impact: Successful exploitation can expose the hypervisor, enable persistence or further movement, and put multiple virtual machines and shared infrastructure at risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Use to prioritise, track and verify remediation for an actively exploited ESXi CVE. |
| Recommendation — Prioritise exposure, patch status and compensating controls for the affected ESXi hosts. | ||
| NIST SP 800-53 Rev 5 | RA-5 — Vulnerability Monitoring and Scanning | This CVE demands monitoring, validation and remediation of a known exploited weakness. |
| SI-2 — Flaw Remediation | Use-after-free flaws require timely flaw remediation and controlled exception handling. | |
| SC-7 — Boundary Protection | Exposure depends on whether management access to port 427 is constrained by network boundaries. | |
| Recommendation — Scan exposed ESXi assets and verify remediation for the vulnerable service path. Apply vendor remediation and track any temporary exceptions until fixed. Restrict management-network reachability to the vulnerable ESXi service. | ||
Practitioner Guidance
Why practitioners should care: Treat ESXi management-plane flaws as infrastructure incidents, not ordinary host bugs, because compromise of the hypervisor can affect everything it runs. Prioritise exposure reduction first when patch timing is constrained.
What to watch for: Any ESXi host with OpenSLP reachable from non-admin networks, especially where segmentation is weak or the management plane is shared with broader internal traffic. The published vulnerability record and vendor guidance should drive version-specific action.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org