Port 7680 – Delivery Optimization (DoSvc)

Port 7680 is opened on Windows 10 and 11 by Delivery Optimization (DoSvc), Microsoft’s peer-to-peer update-sharing service. Delivery Optimization lets a PC pull Windows Update packages, Microsoft Store apps, and some other Microsoft content from other PCs on the local network — and, depending on configuration, from PCs across the internet — instead of downloading everything straight from Microsoft’s servers, which saves bandwidth on networks with many machines. TCP 7680 is the port DoSvc listens on to trade those content chunks with peers. It’s the port people notice when they run netstat on their own PC and ask “why is port 7680 listening — is it a virus?” The short answer is that it’s a normal, signed Windows service, not a sign of compromise. The realistic questions are the same benign-service ones that matter for CDPSvc on port 5040: is this genuinely DoSvc, and is peer sharing scoped the way you actually want it?

Why It’s Open

Delivery Optimization is the content-distribution layer behind Windows Update and the Microsoft Store. When a PC needs an update or Store app, DoSvc can assemble the download from multiple sources in parallel — Microsoft’s CDN, a Microsoft Connected Cache server, and other PCs that already have the same content — then serve its own cached chunks back out to peers. That peer exchange is what puts a listener on TCP 7680.

It’s enabled by default on Windows 10 and 11, which is why so many machines show 7680 listening even though nobody deliberately turned anything on. The behaviour is controlled by the Download Mode setting (DODownloadMode), and the default is LAN (1) — peering with other clients that share the same public IP, i.e. your local network — not internet-wide sharing. The available modes are:

• HTTP Only (0) — no peer-to-peer at all; download straight from Microsoft/CDN or a Connected Cache.
• LAN (1, default) — peer only with devices on the same local network.
• Group (2) — peer within a custom group (AD site, domain, or a GroupID), including across subnets.
• Internet (3) — also peer with arbitrary devices on the internet.
• Simple (99) — no peering and no DO cloud services (offline environments).
• Bypass (100) — deprecated in Windows 11; falls back to BITS.

DoSvc runs as NetworkService inside a shared svchost.exe (its service DLL is dosvc.dll) and starts on demand, so it turns up on laptops, desktops, and VMs alike. Where you find it you’ll often find its Windows-service relatives too, like CDPSvc on port 5040 and WSDAPI on port 5357. (Note: IANA registers 7680 under the legacy name pando-pub, so a scanner may label it that — on modern Windows the owner is Delivery Optimization.)

Common Risks

For a port that’s benign in the common case, it’s worth being precise about where the real risk is:

• Malware masquerading on the port. The single most useful check is confirming the process on 7680 really is a signed svchost.exe hosting DoSvc — not an unsigned binary parked on a “boring” Windows port to blend in. An open 7680 owned by something other than DoSvc is the finding, not the port number itself.
• Peer content is not the weak point. Content pulled from peers is hash-verified against the manifest Windows Update / the Store already trusts — a peer that serves a bad or tampered chunk simply fails the check and the client re-fetches it from the source. So DO peering does not let a malicious PC on your LAN inject a rogue “update.” That’s the part people worry about most, and it’s the part that’s actually sound.
• Unnecessary internet peer sharing. In Internet mode (3), a host will trade chunks with arbitrary internet peers and open 7680 to them — rarely intended on a home or cloud machine, and it leaks device presence and burns upload bandwidth. This is not the default (LAN is), but it’s the setting worth checking on sensitive or metered networks.
• Local privilege escalation. DoSvc has had a run of local elevation-of-privilege bugs (file-share-permission and object-handling issues) that let a low-privileged user already on the box escalate. These need local access — they are not remote 7680 exploits — but on an unpatched host they’re a real post-compromise step.
• Fingerprinting value. An open 7680 reliably confirms “modern Windows host with Delivery Optimization enabled,” which helps an attacker profile the environment during recon — low severity on its own.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

The goal here isn’t to “exploit port 7680” — it’s to confirm the listener is the legitimate DoSvc, verify the binary is the signed Microsoft service, and check how peer sharing is scoped.

See what’s listening and on which address (Windows, elevated)

netstat -anob | findstr 7680

Run from an elevated prompt (-b needs admin). On a healthy host the owning process is svchost.exe and the service is DoSvc. Note the local address: 0.0.0.0:7680 binds all interfaces (the default) and relies on the firewall/download-mode scoping to stay LAN-local.

Map the port to the process and service (PowerShell)

Get-Process -Id (Get-NetTCPConnection -LocalPort 7680).OwningProcess
tasklist /svc | findstr 7680
Get-Service DoSvc | Format-List Name, DisplayName, Status

Check the Delivery Optimization state and download mode

Get-DeliveryOptimizationStatus
Get-DOConfig -Verbose
Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config

Get-DeliveryOptimizationStatus shows active peer connections and where bytes came from; the DODownloadMode value tells you whether the host is LAN-only (1) or peering across the internet (3).

Verify the binary is the genuine, signed Microsoft service

Get-AuthenticodeSignature C:\Windows\System32\svchost.exe
Get-AuthenticodeSignature C:\Windows\System32\dosvc.dll

A valid Microsoft Windows signature on both, running from System32 (not a user or temp path), is what tells you this is the real service and not an impostor.

Check reachability from another host

nmap -Pn -sT -p 7680 <target>

From off-box, 7680 should show filtered on a default-firewalled Windows machine in LAN mode. An open result reachable from another subnet or the internet points to Internet mode and/or missing firewall scoping.

Record anything you confirm — the owning process, the bind address, the download mode, and whether it’s reachable — in the pentest report rather than a scratch file, so the “7680 was internet-facing / was an impostor” finding is documented.

What to Look For

Known CVEs

Port 7680 itself has no remote-exploit history — there is no unauthenticated “port 7680 RCE,” and peer content is hash-verified, so peers can’t push a malicious update. The vulnerabilities that matter are local elevation-of-privilege flaws in the Delivery Optimization service code, which require an attacker to already have code execution on the machine. They’re fixed in the normal Windows monthly updates.

• CVE-2020-0983 — The Windows Delivery Optimization service improperly handles objects in memory, letting an authenticated local user elevate privileges. Affects Windows 10 (1607–1909) and Server 2016/2019. Local only, CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
• CVE-2019-1289 — Windows Update Delivery Optimization does not properly enforce file-share permissions, allowing a local elevation of privilege (CWE-863). Affects Windows 10 and Server 2016/2019. Local only, CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).
• CVE-2017-11829 — The same file-share-permission class in Windows Update Delivery Optimization (CWE-552), a local elevation of privilege on Windows 10 (1607/1703) and Server 2016. Local only, CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).

A previous version of this page listed CVE-2022-24542 as a “Delivery Optimization elevation of privilege vulnerability.” That’s a misattribution — CVE-2022-24542 is a Windows Win32k elevation-of-privilege bug and has nothing to do with Delivery Optimization or port 7680. It has been removed.

Mitigation

Delivery Optimization is a default Windows service that saves real update bandwidth, so for most machines the right call is to leave it running and harden the scope rather than rip it out:

• Keep Windows patched. The DoSvc EoP CVEs above are all local privilege-escalation issues fixed in monthly cumulative updates — routine patching closes them.
• Confirm it’s the real service. Verify the process is a signed svchost.exe hosting dosvc.dll from System32. If it isn’t, treat it as a compromise and investigate, don’t just “close the port.”
• Keep peering local (or off) on sensitive networks. The default LAN (1) already keeps sharing on the local network. To turn peer-to-peer off entirely, set Download Mode to HTTP Only (0) (or Simple (99) for offline hosts) — content still downloads from Microsoft, just without peers. Avoid Internet (3) unless you specifically want internet-wide peering; Bypass (100) is deprecated in Windows 11.
  • GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Download Mode
  • Intune/MDM: DeliveryOptimization/DODownloadMode
  • Registry: HKLM\SOFTWARE\Policies\Microsoft\Windows\DeliveryOptimization\DODownloadMode
• Block 7680 inbound at the host firewall if you don’t want the machine serving chunks to peers — it doesn’t need to accept inbound peer connections for downloads to work.
• Disable DoSvc only if you genuinely don’t want DO (a locked-down server or kiosk). Updates then come straight from Microsoft or WSUS/Configuration Manager:

Stop-Service DoSvc
Set-Service DoSvc -StartupType Disabled

Prefer managing this via Group Policy/MDM across a fleet rather than per-machine, and remember Delivery Optimization complements WSUS/Configuration Manager, it doesn’t replace them.

Real-World Example

The everyday “incident” on port 7680 is a false alarm: someone runs netstat -an, sees 0.0.0.0:7680 LISTENING, searches the number, and concludes their PC has been hacked — when it’s just Delivery Optimization sharing update chunks on the LAN. That reflex isn’t wrong, though; it’s the right instinct pointed at the wrong port. The value of 7680 as a teaching case is that the correct response — map the port to its process, confirm the owning binary is the signed Microsoft service, and check whether the host is peering only on the LAN or reaching out to internet peers — is the same discipline that catches the genuine issues: malware squatting on a mundane, trusted-looking Windows port, or a sensitive machine left in Internet download mode leaking presence and upload bandwidth. On a patched, LAN-scoped host the answer is almost always “benign DoSvc,” but the point is to verify it rather than assume it.

FAQ

Is port 7680 safe, or is it a virus?

On a normal Windows 10/11 machine, port 7680 is safe — it’s Delivery Optimization (DoSvc), a signed Microsoft service that shares Windows Update and Microsoft Store content between PCs to save bandwidth. It’s not a virus. The one way it becomes a concern is if the process listening on 7680 turns out not to be a signed svchost.exe/DoSvc — that would suggest malware masquerading on the port, which is worth confirming with the checks above.

Why is port 7680 listening on my PC?

Because Delivery Optimization is enabled by default on Windows 10 and 11, and DoSvc opens 7680 to exchange update/app chunks with peers. It’s on out of the box in the default LAN mode, so the port appears even if you’ve never deliberately configured anything.

Can another PC push a malicious update to me over port 7680?

No. Delivery Optimization only moves content that Windows Update or the Microsoft Store has already authorized, and every chunk received from a peer is hash-verified against the trusted manifest. A tampered or wrong chunk fails the check and is discarded, then re-fetched from Microsoft — so a peer can’t inject a rogue update through 7680.

Is port 7680 a remote security risk?

Not in a default configuration. In the default LAN mode, peering stays on the local network and the known DoSvc vulnerabilities are all local privilege-escalation bugs that need an attacker already on the machine — there’s no remote “port 7680 exploit.” The realistic concerns are a host left in Internet download mode (peering internet-wide) and confirming the listener is the genuine service.

How do I close or disable port 7680?

To stop the machine peering while still getting updates from Microsoft, set Delivery Optimization Download Mode to HTTP Only (0) via Settings, Group Policy, or DODownloadMode — that frees peer sharing without breaking updates. To disable the service entirely: Stop-Service DoSvc then Set-Service DoSvc -StartupType Disabled (elevated). If you just want it off the network, leave it running and block 7680 inbound at the host firewall.

TL;DR

• Service: Delivery Optimization (DoSvc) — Windows’ peer-to-peer update/app content distribution, hosted in svchost.exe
• Default port: 7680/TCP, opened by default on Windows 10/11 (default download mode is LAN, local-only)
• What it does: shares Windows Update and Microsoft Store content between PCs to cut download bandwidth
• Biggest risk: local privilege-escalation CVEs in DoSvc (need local access); malware masquerading on the port; needless internet peer sharing in Internet mode — not remote RCE, and peer content is hash-verified
• Mitigation: keep Windows patched, confirm it’s the signed service, keep peering LAN-only (or set Download Mode to HTTP Only), block 7680 inbound if unwanted, and disable DoSvc only if you don’t want Delivery Optimization