Ports 5985 and 5986 (WinRM): Risks and Fixes

Written by Ruben Selby, Founder and Lead Security Consultant, Wolfcore. Last reviewed 10 November 2026.

Part of the Wolfcore Resources library: Ports, protocols and services.

In one sentence: Ports 5985 and 5986 let administrators run commands on Windows machines from another computer, which is useful for IT teams and equally useful to an attacker who has found a working login.

What runs on ports 5985 and 5986 (WinRM)

WinRM stands for Windows Remote Management. MITRE describes it as both a Windows service and a protocol that allows a user to interact with a remote system, for example to run an executable, modify the registry or modify services. PowerShell remoting uses it.

Microsoft documents the ports: the default HTTP port is 5985 and the default HTTPS port is 5986. The command winrm quickconfig starts the service and, per Microsoft, opens the ports for HTTP and HTTPS.

Why attackers look for it

It should not be reachable from the internet, so the main use is inside the network. Once an attacker holds one valid account, WinRM is a quiet way to run commands on other servers, because it is a built-in administrative tool. MITRE lists it as a lateral movement technique (T1021.006) and says adversaries may use valid accounts to interact with remote systems and then perform actions as the logged-on user.

How it gets attacked

Stolen or weak credentials. WinRM needs no exploit if the attacker has an administrator password.
Exposed to the internet. A forwarded port or cloud rule that allows 5985 or 5986 from anywhere.
Weak authentication settings. Microsoft notes Basic authentication sends the user name and password in clear text and is the least secure method. The WinRM service has it off by default, but the client default is on, so check both. Allowing unencrypted traffic is also described as not secure.
Plain HTTP listeners. Port 5985 is the HTTP listener, so check whether anything was set up on HTTP where HTTPS (5986) was intended.
Over-trusted hosts. Microsoft says to keep the TrustedHosts list as restricted as possible in workgroups.

MITRE records real groups using it: Chimera used WinRM for lateral movement, and threat actors used it in Operation MidnightEclipse. No CVE is needed for this: it is a legitimate feature used with a stolen login.

Who it affects and how badly

Sole trader to 10 staff: usually not enabled. Worst case is low unless a server is shared.
10 to 250 staff (manufacturing, accountancy, MSPs): domain servers where IT enabled it for convenience. Worst case: an attacker with one admin login reaches every server, with downtime and data loss.
Regulated firms and MSPs: a shared admin account across customers or systems turns one theft into many. Worst case: multi-site outage and notification duties.

What we check on a test

Whether 5985 or 5986 answers from the internet, and from user networks inside the scope.
Which authentication methods the listener accepts.
Whether HTTP listeners exist where HTTPS was intended.
Whether admin accounts are reused across servers.
Whether workstations can reach servers’ WinRM at all.

The UK angle

Cyber Essentials v3.3 says firewalls must block unauthenticated inbound connections by default, and that inbound rules be approved and documented with the business need. MFA is required on administrative accounts and accounts accessible from the internet. A WinRM rule open to the internet would need a clear documented reason.

Diagram

How to check whether yours is exposed

Review firewall rules and cloud security groups for 5985 and 5986.
On a server, run winrm enumerate winrm/config/listener to see the listeners and their ports.
Review which accounts are in the local Administrators group.
Use the free web vulnerability scan for a first outside view.

How to secure it

Block 5985 and 5986 from the internet, and between workstations.
Allow it only from named admin machines or a jump host.
Use HTTPS listeners (5986) with a valid certificate.
Keep Basic authentication and unencrypted traffic disabled on client and service.
Use separate admin accounts with MFA, and avoid reusing one admin password on many servers.
Disable the WinRM service on machines that do not need it.
Log PowerShell activity and remote sign-ins, and alert on admin logins from unusual machines.

FAQ

What are the default WinRM ports? 5985 for HTTP and 5986 for HTTPS.

Is WinRM a vulnerability? No. It is an administrative feature that attackers use after they have a valid login.

Is Basic authentication on by default? On the WinRM service, no. On the client, yes, per Microsoft’s documentation.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan or see penetration testing.

Port 5985 and 5986 (WinRM): what it is, how it is attacked and how to secure it