A clientless remote desktop gateway is an unusual thing to find on the public internet, because the entire product exists to reach machines that are not public. Guacamole turns a browser into an RDP, VNC, and SSH client by proxying those protocols through a server. When that server answers on the internet, the protocol traffic behind it is one credential away.
I queried ZoomEye for three views of the same product on 23 October 2026 and got three very different numbers.

What the queries returned

The application fingerprint query, app="Guacamole", returned 63 matches. The HTML title query, title="Guacamole", returned 4,192. A narrower query combining the title with the product's conventional web port, title="Guacamole" && port="8080", returned 525.
Read together, those three numbers describe three different populations. The fingerprint tracks hosts where the scanner recognised the product from its response characteristics. The title tracks hosts whose HTML contains the string. The port-limited query tracks the subset reachable on the port most deployments use by default.

Why the title number is not an install count

The obvious mistake is to treat 4,192 as the number of Guacamole servers on the internet. A page title match is a string match. It catches the login page of a real deployment, and it also catches documentation sites, tutorial blog posts that quote the title, container registries serving a README, and error pages that echo a project name.
The 63 application matches are the stricter figure, and they are almost certainly an undercount in the other direction: a deployment behind a reverse proxy with a customised login page may present none of the characteristics the fingerprint looks for.
Neither number is a vulnerability count. Both describe assets the scanner could see. What a reader should take from the 66-fold gap is that title-based measurement overstates this product by a wide margin, and fingerprint-based measurement understates it.

Where the risk actually lives

A Guacamole deployment holds connection definitions. Each one contains the address of a target machine, an account name, and usually a stored credential or a reference to one. The gateway is therefore a directory of everything an organisation allows its staff to reach remotely, and in many deployments it is the only component that needs to be internet-facing.
That design puts a lot of weight on the gateway's own authentication. Guacamole delegates authentication to an extension: a database, LDAP, a SAML provider, an OpenID Connect provider, or a header set by a reverse proxy. Which extension is in use determines who can log in, and how much damage a single leaked password causes.
The 525 hosts answering on port 8080 with a Guacamole title are the population where a configuration review would pay off fastest. Not because those hosts are exploitable, but because a product on a non-standard-named port with a login page is a deployment someone stood up quickly, and quick deployments often leave the default administrator account in place.

A reading that survives scrutiny

Say this precisely: on 23 October 2026, ZoomEye returned 63 hosts matching the Guacamole application fingerprint, 4,192 matching the page title, and 525 matching both the title and port 8080, with sub-type set to all. Nothing about those numbers establishes that any host is vulnerable, misconfigured, or unpatched. The version of Guacamole is not visible in any of the three counts.
What the counts do support is a scoping decision. If you own a Guacamole deployment, the population you belong to is small enough that inventory is achievable. If you are assessing third-party exposure, the title count tells you the string is common and the fingerprint count tells you the product is not.

Concrete next steps

Enumerate your own gateways first. For each one, record the authentication extension in use, the source of the connection list, and whether the administrative interface is reachable from the same network as the login page. The administrative interface and the user interface are separate parts of the product with different risk profiles, and conflating them in an inventory hides the more important one.
Then check what the gateway can reach. A Guacamole server that can open RDP to every workstation in a domain is a lateral-movement path disguised as a convenience. Limiting its egress to the hosts it is meant to broker is a configuration change that survives the next vulnerability scare.
For external measurement, use the fingerprint query rather than the title query when you want a defensible number, and state the query text, the sub-type, and the collection time alongside it. A count without those three attributes is a number looking for an argument.

The measurement lesson

Guacamole is a good example of a product whose public footprint is almost invisible to naive search and modest even to careful search. That is not a reason to relax. The gateway with 63 fingerprint matches and the gateway that the scanner could not fingerprint both hold the same connection definitions, and only one of them appears in a report.

References

  • Apache Guacamole project, https://guacamole.apache.org/

  • Apache Guacamole manual, architecture and connection model, https://guacamole.apache.org/doc/gug/guacamole-architecture.html

  • ZoomEye AI query results collected 23 October 2026 for app="Guacamole", title="Guacamole", and title="Guacamole" && port="8080", sub-type all