86
Summary
- // if you see it open
- Internal management surface for COBOL enterprise products — the MFDS console is intended for management-network use only and must never be exposed to the public internet; restrict TCP 86 to trusted management segments. Port is in the System Ports range (0-1023) so binding needs elevated privileges. No specific CVEs or active exploit campaigns targeting port 86 were found in this pass. A trojan/backdoor association claimed by some secondary port sites is NOT corroborated by authoritative trojan-port lists (Gary Kessler and chebucto both omit port 86) and is treated as unverified/low-confidence.
- // analyst note
- A responsive port 86 most plausibly indicates a COBOL Enterprise Server / MFDS deployment; the management console should be on an internal segment, so an internet-exposed port 86 is a misconfiguration worth flagging.
About port 86/tcp.
Port 86/tcp is registered with IANA as mfcobol with the description "Micro Focus Cobol," contact Simon Edwards, and a blank reference field (dual-registered on TCP and UDP, with 86/udp carrying the identical service name and description). In practice the port belongs to the Micro Focus COBOL networking layer — specifically CCITCP2, the Common Communications Interface over TCP — and is the default listening port for the Micro Focus Directory Server (MFDS), the process (mfds) that runs Enterprise Server regions where COBOL application environments execute. MFDS exposes a web-based administration console reachable at http://host:86 for managing those regions, and CCITCP2 falls back to port 86 when the CCITCP2_PORT environment variable is unset and no mfcobol entry is found in /etc/services. Because port 86 sits in the IANA System Ports range (0–1023), binding it requires elevated privileges on Unix/Linux. This is an internal management surface for enterprise COBOL deployments, not a public-facing service: the MFDS console is intended for management-network use only and should never be exposed to the internet. The product lineage matters for identification — Micro Focus was acquired by OpenText in 2022, and the COBOL product line was divested to Rocket Software in 2024, which is why the IANA contact (Simon Edwards) is at Rocket Software and why much of the original Micro Focus documentation has since 404'd. Software seen on this port includes Micro Focus / Rocket Software Enterprise Server and Enterprise Developer, plus the legacy Net Express and Server Express products. For an analyst, a responsive port 86 most plausibly indicates a COBOL enterprise deployment's directory/management service. No specific CVEs or active exploit campaigns targeting port 86 surfaced in this research pass. Some secondary port-reference sites mention a historical trojan/backdoor association with port 86, but that claim is not corroborated by authoritative trojan-port reference lists (both the Gary Kessler "bad ports" list and the chebucto trojan-port table omit port 86 entirely), so it should be treated as unverified and low-confidence.
- IANA assignment
mfcobol— "Micro Focus Cobol"; reference (blank — no RFC cited in IANA registry); contact Simon Edwards; dual-registered 86/tcp + 86/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=86)- Range class
- system / well-known (0–1023); binding requires elevated privileges on Unix/Linux [Confirmed] — IANA registry; internet-security.com/ports/port-86-TCP.html
- IANA registration/modification date
- none recorded — the IANA service-names registry leaves the registration_date and modification_date columns blank for 86/tcp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry
- Related ports
- other enterprise-application management ports; contrast public-facing HTTP (80/443)
Primary use
Micro Focus COBOL networking layer — CCITCP2 (Common Communications Interface over TCP) and the Micro Focus Directory Server (MFDS), whose web admin console listens at http://host:86
Common software
Micro Focus / Rocket Software Enterprise Server and Enterprise Developer (mfds process); legacy Net Express and Server Express
Security implications
internal management surface; MFDS console must not be internet-exposed; restrict TCP 86 to trusted management segments. No specific CVEs or active campaigns found this pass
Typically seen on
Micro Focus / Rocket Software COBOL enterprise hosts; otherwise an anomaly worth investigating
- Default-fallback behavior
- CCITCP2 uses port 86 when CCITCP2_PORT is unset and no
mfcobolentry exists in /etc/services [Likely] — connected.app/bn/ports/86 - Product lineage
- Micro Focus acquired by OpenText (2022); COBOL line divested to Rocket Software (2024); IANA contact Simon Edwards now at Rocket Software [Likely] — connected.app/bn/ports/86; IANA registry contact
- Trojan/backdoor association
- claimed by some secondary port sites but NOT corroborated — Gary Kessler "bad ports" and chebucto trojan-port table both omit port 86; treat as unverified/low-confidence [Likely-unverified] — garykessler.net/library/bad_ports.html; chebucto.ns.ca/~rakerman/trojan-port-table.html
- Analyst note
- A responsive port 86 most plausibly indicates a COBOL Enterprise Server / MFDS deployment; the management console should be on an internal segment, so an internet-exposed port 86 is a misconfiguration worth flagging.
About port 86/udp.
Port 86/udp is registered with IANA as mfcobol with the description "Micro Focus Cobol," assignee Simon Edwards, and a blank reference field; it is dual-registered on TCP and UDP under the same service name. The assignment belongs to Micro Focus's COBOL middleware line, where the port is bound by the CCITCP2 server-registration daemon — a background process that registers and advertises CCI (Common Communications Interface) server processes so CCI clients can locate and connect to them over TCP/IP. The UDP side of port 86 carries broadcast discovery: when a CCITCP2 client does not have the daemon's address preconfigured, it sends a UDP broadcast on port 86 to find the local ccitcp2 instance, and routers or bridges between segments must pass these packets unfiltered for cross-segment discovery to work. An /etc/services entry mfcobol 86/udp is expected by the runtime; its absence produces error CCITC32-0034E. For an analyst, the practical signals are narrow: port 86/udp is a legacy enterprise middleware port confined to internal networks running Micro Focus (now OpenText) Net Express, Server Express, Visual COBOL, or COBOL Server, not a publicly exposed service. The main exposure concern is the broadcast behavior itself, which can leak internal COBOL server topology on local segments; Micro Focus's documented mitigation is to preconfigure the CCITCP2 environment variable on clients so they contact the daemon directly and stop broadcasting. No CVEs specific to port 86 or mfcobol were found in public databases, and a generic "trojan in the past" flag on third-party port-reference sites is unverified, names no malware family, and should not be treated as a current threat indicator.
- IANA assignment
mfcobol— "Micro Focus Cobol"; reference (blank — no RFC/document cited in IANA registry); assignee Simon Edwards; dual-registered 86/tcp + 86/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry; the IANA Service Name and Transport Protocol Port Number Registry line 241- Range class
- well-known (0–1023) [Confirmed] — IANA
- Registration date
- Unknown (blank in IANA registry) [Confirmed] — IANA registry
- Modification date
- Unknown (blank in IANA registry) [Confirmed] — IANA registry
- Related ports
- 86/tcp (same
mfcobolregistration)
Primary use
CCITCP2 server-registration daemon for Micro Focus COBOL CCI middleware; UDP 86 carries broadcast service-discovery queries when the daemon address is not preconfigured
Common software
Micro Focus Net Express, Server Express, Visual COBOL, COBOL Server (rebranded OpenText COBOL Server); ccitcp2 daemon binds the port; an /etc/services mfcobol 86/udp entry is required or error CCITC32-0034E results
Security implications
UDP broadcast discovery can leak internal COBOL server topology on local segments; documented mitigation is to preconfigure the CCITCP2 environment variable so clients contact the daemon directly; no CVEs found for mfcobol/port 86; a generic third-party "trojan" flag is unverified
Typically seen on
internal networks running legacy Micro Focus / OpenText COBOL middleware
- Scanning/exposure
- not commonly exposed on the public internet; use is confined to internal enterprise networks; UDP connectionlessness makes open-vs-filtered unreliable to distinguish without an application response; no Shodan/SANS ISC trend data found specific to 86/udp [Likely] — auditmypc.com; Micro Focus docs
- Analyst note
- An open 86/udp almost always indicates a legacy Micro Focus COBOL deployment doing CCI service discovery; investigate broadcast scope rather than assuming a public-facing service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| mfcobol | UDP | Micro Focus Cobol | 0.08% |
| mfcobol | TCP | Micro Focus Cobol | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.