8,000 Exposed VNC Instances: Critical Infrastructure Remote Access Risks and Defenses for 2026

Researchers discovered over 8,000 unprotected virtual network computing instances exposing critical infrastructure networks, from water treatment plants to research facilities, to potential cyber-attacks. Here’s how organizations can strengthen VNC security and how SASE offers an innovative way to protect critical systems.

Ozan Ucar, Founder and CEO of Keepnet

Last Updated: 2026-06-01

8,000 Unprotected VNCs Put Global CNI Organizations at High Risk

8,000 Unprotected Virtual Network Instances Expose Critical Infrastructure: What You Need to Know

In 2022, security researchers identified over 8,000 instances of unprotected Virtual Network Computing (VNC) servers accessible from the public internet with authentication disabled. The discovery highlighted a systemic failure in remote access security across critical national infrastructure. By 2026, the exposure of unprotected remote access services remains one of the most persistent and exploited vulnerabilities in industrial and operational technology environments. Threat intelligence reports consistently show that internet-exposed VNC, RDP, and industrial control system interfaces represent a primary initial access vector for attacks on critical infrastructure, with nation-state actors and ransomware operators actively scanning for these exposures.

VNC is a widely used remote desktop protocol that enables engineers and operators to control industrial and operational systems remotely. Its cross platform support and ease of deployment make it attractive for operational technology environments. However, when VNC instances are exposed to the internet without authentication or encryption, they become trivial entry points for attackers. In 2026, automated scanning tools enable threat actors to discover and attempt to access internet-exposed VNC services within minutes of their exposure, making the window between accidental exposure and exploitation extremely short.

Why Unprotected VNCs Are a Major Threat to CNI

For organizations that manage essential services, any compromise can result in catastrophic impacts. CNI sectors, including energy, water, and healthcare, depend heavily on VNCs for remote monitoring, troubleshooting, and management of industrial systems. When VNC access lacks authentication, it exposes endpoints and ICS to unauthorized remote control, data manipulation, and potential sabotage.

VNCs’ vulnerability arises from factors such as:

Lack of Authentication Controls: When authentication is disabled, any actor on the internet could potentially access and control these systems.
Outdated Software and Lack of Maintenance: Older VNC systems may lack essential updates or patches, further increasing vulnerability.
Misconfigured Network Access: Open network access increases the risk of unauthorized entry, especially if VNC connections are not secured behind a firewall or VPN.

The Role of SASE in Protecting Critical Infrastructure

Security Access Service Edge, or SASE, offers a cloud based solution to secure network architectures, particularly in environments where legacy systems can’t be taken offline for updates. By deploying virtual patches, SASE allows organizations to manage their critical infrastructure without physically updating each component. This feature is especially crucial for CNI organizations, where interruptions to ICS could lead to service disruptions or safety hazards.

SASE’s Key Advantages for VNC and CNI security include:

Unified Security Policies: SASE enables centralized management, ensuring consistent security protocols across different remote access points.
Reduced Vulnerability to Legacy System Risks: By using virtual patches, SASE can secure outdated VNC instances without needing full updates, which can be logistically challenging in legacy environments.
Integrated Threat Intelligence: SASE uses real time threat data to proactively protect network endpoints, reducing the likelihood of successful exploitation attempts.

For CNI organizations, transitioning to a SASE model can mitigate risks associated with VNC by bolstering endpoint security through a cloud based, comprehensive, and adaptive framework.

VNC Security Best Practices for CNI Organizations

To protect against potential threats, organizations managing critical infrastructure should consider the following VNC security practices:

1. Enable Strong Authentication

Disabling VNC’s built in authentication creates vulnerabilities that can be exploited easily. Instead, organizations should enable multi factor authentication (MFA) to strengthen access control.

2. Regularly Update and Patch Systems

Outdated software is a significant security weakness. IT teams should establish a routine patching schedule or leverage virtual patching solutions through SASE to protect VNC instances.

3. Segment Networks

Network segmentation limits the scope of any unauthorized access. By separating VNC controlled systems from sensitive ICS and data networks, organizations reduce the risk of widespread compromise.

4. Use Secure Network Configurations

A firewall should be configured to restrict access to VNC, allowing connections only from trusted IP addresses or through a VPN. This restricts VNC access to authorized personnel and adds a critical layer of security.

5. Monitor Network Traffic and Access Logs

Continuous monitoring of network activity and VNC access logs can help organizations quickly identify and respond to any suspicious behavior.

How SASE providers’ SASE Solution Enhances VNC Security

SASE providers has emerged as a leader in securing cloud based access services, particularly for organizations requiring seamless and safe remote connections. A SASE platform combines advanced threat detection, virtual patching, and unified management to provide a robust security framework for VNC and other remote access tools.

SASE platforms allow critical infrastructure organizations to apply virtual patching, blocking exploitation of known vulnerabilities in legacy OT systems without requiring downtime for firmware updates. This is particularly valuable for industrial environments where availability requirements prevent traditional patching cycles.

By adopting SASE’s cloud based approach, organizations benefit from the following:

Reduced Downtime: Virtual patching prevents the need to take systems offline, reducing operational disruptions.
Improved Compliance: CNI organizations are subject to strict compliance requirements. SASE’s robust security protocols can help meet industry standards, including those mandating stringent access control for ICS.
Enhanced Threat Visibility: Cato’s SASE platform offers real time monitoring and threat intelligence, enabling rapid response to any detected anomalies.

Moving Forward: Protecting CNI with Comprehensive VNC Security

As critical infrastructure continues to expand its use of remote access tools, the risk of unprotected VNC instances persists. In 2026, regulatory frameworks including the EU NIS2 Directive and the US Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) impose new obligations on critical infrastructure operators to manage and report security incidents. Organizations that have not audited their internet-exposed services, implemented authentication controls on all remote access tools, and deployed continuous external attack surface monitoring are exposed to both operational risk and regulatory penalty. The 2022 discovery of 8,000 unprotected VNCs was a warning; in 2026, the same exposures continue to appear in new infrastructure every day.

Editor's Note: This article was updated on June 1, 2026.

Schedule your 30-minute demo now

You'll learn how to:

Implement virtual patching to secure legacy VNC systems without costly infrastructure updates.

Centralize security for critical infrastructure with unified SASE policies.

Monitor and respond to real-time threats for uninterrupted service protection.

Frequently Asked Questions

What is VNC and why is it used in critical infrastructure?

Virtual Network Computing (VNC) is a remote desktop protocol that allows users to view and interact with a remote computer's screen over a network. It is widely used in critical national infrastructure (CNI) because it enables engineers and operators to remotely manage industrial control systems, supervisory control and data acquisition (SCADA) systems, and operational technology (OT) devices without being physically present. VNC's cross platform support and ease of deployment make it attractive for operational environments, but its security model was not designed for exposure to the public internet.

Why were 8,000 VNC instances left exposed to the internet?

Security researchers found that over 8,000 VNC instances were accessible from the public internet with no authentication required. Common reasons for this configuration include: devices deployed for emergency remote access during operational incidents and never secured afterward; misconfigured network rules that inadvertently exposed VNC ports; IT teams unaware that VNC was installed on operational technology devices; and the absence of systematic monitoring for exposed services. In environments where operational continuity is prioritized over security hygiene, such misconfigurations can persist undetected for long periods.

What can attackers do with unauthorized VNC access to critical infrastructure?

An attacker with unauthorized VNC access to a critical infrastructure device can view and interact with the device's screen, potentially observing operator activities and system states; manipulate industrial control systems to alter processes, cause equipment malfunction, or trigger safety failures; deploy malware or ransomware to operational technology systems; establish persistent access for long term espionage or sabotage; and pivot to other connected systems on the operational network. The consequences for water treatment facilities, energy grids, or healthcare systems could include physical harm to the public.

What is the difference between IT and OT security and why does it matter for VNC exposure?

IT (information technology) security focuses on protecting data systems, servers, and endpoint devices. OT (operational technology) security focuses on protecting industrial control systems that manage physical processes. OT environments often run legacy systems that cannot be easily patched or updated without operational risk, have different availability and integrity requirements from IT systems, and have historically been isolated from the internet. As OT and IT networks converge to enable remote management, OT devices like those accessible via VNC are increasingly exposed to internet based attacks they were never designed to withstand.

What authentication controls should be applied to VNC installations?

At minimum, VNC installations should require strong password authentication. Where the VNC software supports it, certificate based authentication provides stronger protection. VNC should never be directly exposed to the public internet; instead, access should be routed through a VPN or other secure remote access solution that requires its own authentication. Multi factor authentication should be applied at the VPN or remote access gateway level. Organizations should also maintain an inventory of all VNC installations to ensure none are inadvertently exposed.

What is SASE and how does it help secure remote access to critical infrastructure?

Secure Access Service Edge (SASE) is a cloud delivered security architecture that combines network security and wide area networking functions. For critical infrastructure organizations, SASE can provide centralized security policy enforcement for all remote access, zero trust network access that verifies every connection attempt regardless of location, virtual patching that blocks exploitation of known vulnerabilities in legacy OT systems without requiring firmware updates, and continuous monitoring of remote access sessions. These capabilities address the specific challenges of securing remote access to operational technology environments.

How should organizations discover and remediate exposed VNC instances?

Organizations should conduct regular external attack surface assessments that scan for internet exposed services including VNC ports (5900-5902). Internal scanning should also identify VNC installations on OT networks. Any exposed VNC instance should be immediately secured by disabling public access, requiring authentication, and routing access through a VPN. Organizations should establish a policy requiring all remote access installations to be documented, approved by security teams, and regularly reviewed. Automated external monitoring tools can provide ongoing visibility into newly exposed services.

What is network segmentation and why is it important for protecting VNC installations?

Network segmentation divides a network into isolated zones with controlled traffic between them. For critical infrastructure, segmentation ensures that VNC accessible OT devices are isolated from corporate IT networks and the internet, so that a compromise of an internet facing system cannot directly reach OT systems. Properly segmented networks require an attacker to compromise multiple barriers to reach critical control systems, limiting the blast radius of any single breach and slowing lateral movement. VNC devices should sit behind firewalls that restrict access to specific authorized IP addresses.

What are the regulatory implications of leaving critical infrastructure systems exposed?

Many countries have regulations governing the cybersecurity of critical infrastructure. In the UK, the Network and Information Systems (NIS) Regulations require operators of essential services to implement appropriate technical and organizational measures to manage security risks. In the US, sector specific regulations cover energy, water, and other critical infrastructure sectors. Leaving 8,000 internet accessible VNC instances unprotected would likely constitute a failure to implement appropriate security measures under these frameworks, potentially triggering regulatory investigations and penalties in addition to the operational consequences of any exploitation.

How can security awareness training support critical infrastructure cybersecurity?

Critical infrastructure operators need staff who understand the specific security risks of OT environments, recognize social engineering attacks targeting operational personnel, know how to report security incidents, and follow secure remote access procedures. Many OT security incidents begin with a phishing email or social engineering attack against an employee. Keepnet's Security Awareness Training and Phishing Simulator provide the human layer defenses that complement technical controls in protecting critical infrastructure.