535

Port 535/tcp carries iiop, the Internet Inter-ORB Protocol used by CORBA distributed object systems; it should stay internal-only rather than be exposed to the public internet. IANA registers the name with no RFC or other reference cited, so the assignment is a bare service-name registration rather than a documented protocol standard on this specific port.

IIOP is the CORBA-family wire protocol used for communication between distributed object request brokers (ORBs), letting objects hosted on different servers invoke methods on each other. The IANA registry lists iiop on both 535/tcp and 535/udp, assignee Jeff M. Michaud, with a blank Reference field and no registration or modification date available from the public listing.

Real-world CORBA/IIOP deployments (checked directly for this entry, including IBM WebSphere and Oracle WebLogic) commonly document different default ORB ports — figures like 2809, 9100/9101, or 683 turn up in vendor and community discussion — and no credible, attributable source was found naming 535 specifically as an in-use default or observed port for any IIOP product. Two automated web-search summaries claimed the port relates to RTSP or Apple Filing Protocol; both are almost certainly wrong (RTSP is conventionally 554, AFP is conventionally 548) and neither cited a checkable source, so they are excluded here.

Nmap's service-frequency data shows the port as essentially never observed open in practice, consistent with iiop/535 being a registered-but-rarely-deployed assignment rather than an actively used service.

Exposure

CORBA/IIOP is enterprise middleware for inter-ORB object calls, not a service designed for public reach; treat 535/tcp as internal-only and restrict it to trusted application-tier networks.

Prevalence

nmap-services open-frequency for 535/tcp is 0.000013 (~0.0013%), and 0.000329 (~0.033%) for 535/udp — both near the low end of the measured corpus [Confirmed] — this site's own tooling

Malware association

Unknown as of an August 2026 search; no vendor or community source was found documenting Trojan or malware use of this specific port.

Notable CVE

none identified for iiop on port 535 specifically as of an August 2026 search; omitted rather than naming an unverified one.

IANA assignment

iiop — "iiop"; reference (blank — no RFC cited in IANA registry); assignee Jeff M. Michaud; dual-registered 535/tcp + 535/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry iiop 535/tcp

Range class

well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry iiop 535/tcp

Prevalence

nmap-services open-frequency 535/tcp ≈ 0.000013 (~0.0013%); 535/udp ≈ 0.000329 (~0.033%) [Confirmed] — this site's own tooling

Related ports

other IIOP/CORBA-associated ports discussed in vendor/community docs — 683 (corba-iiop), 2809, 9100/9101 (WebSphere ORB defaults) [Likely] — vendor/community documentation, not port-535-specific

Primary use

Internet Inter-ORB Protocol (IIOP), the CORBA distributed-object wire protocol; registry entry carries no further description beyond the bare service name

Other/unofficial uses

none identified from a credible, attributable source as of an August 2026 search [Unknown]

Security implications

no documented malware/Trojan association found; blank IANA reference field; not a service intended for internet exposure

Typically seen on

no confirmed vendor default matches port 535 specifically; common CORBA/IIOP implementations document other default ORB ports (e.g. 2809, 9100/9101, 683)

Analyst note

An open port 535 is rare in scan telemetry; if seen, verify it is a legitimate CORBA/IIOP endpoint on an internal application tier rather than assuming a standard vendor default.

Port 535/udp is registered with IANA under the name iiop (Internet Inter-ORB Protocol), the CORBA wire protocol used by object request brokers to communicate over TCP/IP; it should stay internal-only rather than face the public internet, since object-invocation protocols of this kind carry an unauthenticated-access risk when reachable externally.

IANA lists iiop as dual-registered on both 535/tcp and 535/udp, assignee Jeff M. Michaud, with a blank Reference field — no RFC document backs the assignment. Registration and modification dates are not recorded in the registry.

In practice, general CORBA/IIOP deployments (e.g. Java RMI-IIOP, Oracle/WebLogic application servers) run on administrator-configured ports rather than the IANA-assigned 535. Oracle's own documentation is concrete about this: for Sun ONE Application Server 7, Enterprise Edition, "the default port number for the default IIOP listener port is 3700", and additional listeners take whatever unique port an administrator types in. Traffic on 535 being genuine IIOP could not be independently confirmed beyond the registry entry itself.

Measured open-frequency from the nmap-services corpus puts 535/udp at 0.000329 (about 0.033% of scanned hosts) and 535/tcp at 0.000013 — both low, consistent with a rarely-deployed service. No CVE or vendor advisory specific to port 535 was found as of an August 2026 search, and SANS Internet Storm Center's port page shows only light, non-specific scanning.

Exposure

Internal-only — CORBA/IIOP object invocation is not designed for public-internet exposure and should be limited to trusted networks if it is run at all.

Notable CVE

none recorded in the NVD or vendor advisories specific to port 535 as of an August 2026 search.

Scanning activity

SANS Internet Storm Center's port-535 page shows only light, non-specific scanning-source activity as of an August 2026 check, with no documented exploitation campaign.

Malware association

none confirmed — the SANS ISC port-535 page carries empty trojan and CVE Links sections as of an August 2026 check [Likely] — https://isc.sans.edu/data/port/535

IANA assignment

iiop — description "iiop"; Reference blank; assignee Jeff M. Michaud; dual-registered 535/tcp + 535/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry iiop 535/udp

Range class

well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry iiop 535/udp

Prevalence

nmap-services open-frequency 535/udp = 0.000329 (~0.033%); 535/tcp = 0.000013 (~0.0013%) [Confirmed] — this site's own tooling

Related ports

535/tcp (the same iiop registration on the other transport) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry iiop 535/tcp

Primary use

IANA registers 535 for iiop (Internet Inter-ORB Protocol), the CORBA ORB-to-ORB wire protocol; no RFC is cited in the registry

Other/unofficial uses

none confirmed on this specific port; general CORBA/IIOP deployments in practice use administrator-configured ports — Sun ONE Application Server 7 defaults its IIOP listener to 3700, not 535, and further listeners are given an operator-chosen port

Security implications

no CVE or advisory specific to port 535 found as of an August 2026 search; general CORBA/IIOP class risk (unauthenticated object invocation) applies if deployed; observed internet scanning is light and non-specific

Typically seen on

Unknown — no confirmed real-world deployment pattern for this specific port was found [Unknown]

Malware associations

none found; the SANS ISC port-535 page carries empty trojan and CVE Links sections

Analyst note

A responsive port 535 has no confirmed typical role beyond the bare IANA iiop registration; treat it as low-prevalence and, if genuinely CORBA/IIOP traffic, restrict to internal networks rather than expecting public exposure.