Pwn2Own Berlin 2026 Day Three: Zero-Days Demonstrated in VMware ESXi, Microsoft SharePoint, Windows 11, Red Hat Linux, and Anthropic Claude Code

Pwn2Own Berlin 2026 Day Three (TL-2026-1546), also tracked as Pwn2Own Berlin 2026, is a high-severity software vulnerability, first published 2026-07-19. It has no confirmed attribution, affects Broadcom/VMware VMware ESXi, maps to 23 MITRE ATT&CK techniques (T1003, T1046, T1059), and is covered by 9 detection rules and 33 indicators of compromise.

Key facts for TL-2026-1546

Threat ID
TL-2026-1546
Also known as
Pwn2Own Berlin 2026, Pwn2Own Berlin 2026 Day Three
Severity
HIGH
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-19
Last reviewed
2026-07-19
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, cloud hosting, government administration, finance, health, critical-infrastructure, software-development
Target regions
Global, North America, Europe, Asia
Detection rules
9
Indicators of compromise
33

Malware and tooling in Pwn2Own Berlin 2026 Day Three

Malware and tooling: Anthropic Claude Code, Cursor, OpenAI Codex

At Pwn2Own Berlin 2026 (OffensiveCon, May 14-16, 2026), competing research teams demonstrated 47 unique zero-day exploit chains for a record $1,298,250 payout, including a $200,000 VMware ESXi cross-tenant memory-corruption exploit, a $100,000 two-bug Microsoft SharePoint chain, Windows 11 and Red Hat Enterprise Linux privilege-escalation chains, and repeated compromises of a new 'Coding Agent' category covering Anthropic Claude Code, OpenAI Codex, and Cursor. DEVCORE Research Team won Master of Pwn overall with $505,000; vendors have not yet published patches and ZDI withholds full technical detail under its 90-day coordinated-disclosure timeline.

How Pwn2Own Berlin 2026 Day Three works

Pwn2Own Berlin 2026, organized by Trend Micro's Zero Day Initiative (ZDI) and co-located with OffensiveCon, ran May 14-16, 2026 and closed with 47 unique zero-day vulnerabilities disclosed for a total of $1,298,250 - a roughly 20% increase over the prior year's $1,078,750. ZDI reported a 450% year-over-year surge in contest submissions, which Dustin Childs (ZDI head of threat awareness) attributed to researchers using AI coding tools both to discover bugs and to draft the documentation required for contest registration; nearly 100 entries arrived in the final 72 hours before registration closed, forcing ZDI to reject over 150 working zero-day chains for the first time in the event's 19-year history and to deploy its own agentic-AI triage pipeline to filter submissions down to a reviewable volume.

Day One (24 unique 0-days, $523,000) featured Orange Tsai (DEVCORE) chaining four logic bugs to escape the Microsoft Edge sandbox ($175,000/17.5 pts), Valentina Palmiotti (IBM X-Force) rooting an NVIDIA Container Toolkit 0-day ($50,000) and Red Hat Linux for Workstations ($20,000), and k3vg3n chaining SSRF plus code injection to exploit LiteLLM ($40,000/4 pts). Day Two (15 unique 0-days, $385,750, running total $908,750) featured Cheng-Da Tsai/Orange Tsai (DEVCORE) chaining three bugs for unauthenticated remote code execution as SYSTEM against Microsoft Exchange ($200,000), Siyeon Wi escalating privileges on Windows 11 via integer overflow ($7,500/3 pts), and Ben Koo (Team DDOS) rooting Red Hat Enterprise Linux for Workstations ($10,000).

Day Three (final day, bringing the contest to $1,298,250 / 47 zero-days) delivered the highest single payout of the event: Nguyen Hoang Thach of STARLabs SG chained a memory-corruption bug in VMware ESXi with the contest's Cross-tenant Code Execution add-on objective for $200,000 and 20 Master of Pwn points - a hypervisor escape with direct cross-tenant blast radius in shared virtualization environments. splitline of DEVCORE Research Team chained two distinct bugs to achieve exploitation of Microsoft SharePoint for $100,000 and 10 points. Le Tran Hai Tung, dungnm, and hieuvd of Viettel Cyber Security used an integer overflow to escalate privileges on Windows 11 in the event's fifth successful round against that target, earning $7,500 and 3 points. Hyunwoo Kim chained a use-after-free with an uninitialized-memory read to escalate privileges on Red Hat Enterprise Linux for Workstations, earning $5,000 and 2 points. Sina Kheirkhah of Summoning Team scored a partial-credit collision against Red Hat Linux (one bug previously known) for $7,000 and 1.5 points, while a teammate, Giuseppe Cali, timed out attempting a separate VMware ESXi entry.

The contest's newly introduced 'Coding Agent' category - covering Anthropic Claude Code, OpenAI Codex, and Cursor - drew sustained attention across all three days as ZDI required exploits to originate from realistic coding-agent use cases and to cross a sandbox or permission boundary (i.e., achieve impact beyond the agent's intended blast radius, such as host code execution or unauthorized external control). Satoki Tsuji of Ikotas Labs abused an external control/permission-boundary flaw in OpenAI Codex to trigger unintended behavior and spawn multiple calculator instances (a canonical PoC-of-concept RCE demonstration), earning $20,000 and 4 points - the third successful Codex compromise of the event. Anthropic Claude Code was hit twice on Day Three, both as partial-credit collisions rather than fresh zero-days: a five-person Compass Security team (Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller) triggered a one-vulnerability collision with a bug from an earlier attempt, and Byung Young Yi of Out Of Bounds independently reproduced a previously disclosed Claude Code bug; each collision still paid $20,000 and 2 Master of Pwn points under ZDI's partial-credit rules. Analysis from Trend Micro and independent researchers characterized the AI coding-agent category's root causes as consistent across all three targeted products: overpowered underlying developer tooling (broad filesystem/shell/network access granted to the agent runtime) and misplaced trust boundaries between the agent, its host permissions, and the user-supplied task - the same class of weakness abused in real-world incidents where attackers wrap malicious instructions as 'authorized red-team' prompts to get Claude/Codex-class agents to autonomously enumerate, exploit, and monetize compromised infrastructure.

No CVE identifiers, CVSS scores, or public proof-of-concept code have been published for any Pwn2Own Berlin 2026 finding as of this writing. Per ZDI's standard coordinated-disclosure process, all 47 vulnerabilities were privately reported to the affected vendors (VMware/Broadcom, Microsoft, Red Hat, Anthropic, OpenAI, NVIDIA, Mozilla, and others) with a 90-day window before technical write-ups and CVE assignment become public; researchers and defenders should treat every named product/version as pending-disclosure and monitor vendor advisories and the ZDI upcoming-advisories list for the associated CVEs.

MITRE ATT&CK techniques used in TL-2026-1546

Credential Access

T1003 OS Credential Dumping; T1552 Unsecured Credentials

Discovery

T1046 Network Service Discovery; T1518 Software Discovery; T1580 Cloud Infrastructure Discovery

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host

Command and Control

T1071 Application Layer Protocol

Initial Access

T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise; T1199 Trusted Relationship

Lateral Movement

T1210 Exploitation of Remote Services

Defense Evasion

T1211 Exploitation for Stealth

Collection

T1213 Data from Information Repositories

Impact

T1489 Service Stop

Resource Development

T1587 Develop Capabilities

Reconnaissance

T1595 Active Scanning

execution

T1610 Deploy Container

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Pwn2Own Berlin 2026 Day Three

  • Broadcom/VMware — VMware ESXi
    Vulnerable versions: undisclosed - pending ZDI 90-day window
  • Microsoft — SharePoint
    Vulnerable versions: undisclosed - pending ZDI 90-day window
  • Microsoft — Windows 11
    Vulnerable versions: undisclosed - pending ZDI 90-day window
  • Microsoft — Exchange
    Vulnerable versions: undisclosed - pending ZDI 90-day window
  • Microsoft — Edge
    Vulnerable versions: undisclosed - pending ZDI 90-day window
  • Red Hat — Red Hat Enterprise Linux for Workstations
    Vulnerable versions: undisclosed - pending ZDI 90-day window
  • Red Hat — Red Hat Linux
    Vulnerable versions: undisclosed - pending ZDI 90-day window
  • Anthropic — Claude Code
    Vulnerable versions: undisclosed - pending ZDI 90-day window
  • OpenAI — Codex
    Vulnerable versions: undisclosed - pending ZDI 90-day window
  • NVIDIA — NVIDIA Container Toolkit
    Vulnerable versions: undisclosed - pending ZDI 90-day window

Remediation for Pwn2Own Berlin 2026 Day Three

Patches

  • No vendor patches published as of 2026-05-16; VMware/Broadcom, Microsoft, Red Hat, Anthropic, OpenAI, and NVIDIA are under ZDI's standard 90-day private-disclosure window for all Pwn2Own Berlin 2026 findings
  • Monitor VMware Security Advisories (ESXi), Microsoft Security Response Center (SharePoint, Windows 11, Exchange, Edge), Red Hat Product Security (RHEL/Red Hat Linux for Workstations), Anthropic security disclosures (Claude Code), and OpenAI security disclosures (Codex) for forthcoming fixes

Immediate actions

  • Inventory every VMware ESXi, Microsoft SharePoint, Windows 11, Red Hat Enterprise Linux/RHEL Workstations, Microsoft Exchange, Microsoft Edge, and NVIDIA Container Toolkit instance and track vendor advisories for Pwn2Own Berlin 2026-derived CVEs as they publish
  • For AI coding-agent deployments (Claude Code, OpenAI Codex, Cursor or equivalents), restrict the agent runtime's filesystem, shell, and outbound network access to the minimum needed for the declared task and disable auto-approval of shell/tool calls in unattended or CI contexts
  • Treat any 'authorized red-team' framing embedded in an agent prompt or task description as untrusted input requiring separate human authorization, not as sufficient justification for the agent to bypass its own safety guardrails
  • Segment VMware ESXi tenants and enforce strict inter-tenant isolation controls (network, storage, vMotion) pending patch for the disclosed cross-tenant code-execution primitive
  • Subscribe to the ZDI upcoming advisories feed and CISA KEV to catch the 90-day disclosure window for all 47 Pwn2Own Berlin 2026 findings

Workarounds

  • Where feasible, run AI coding-agent sessions inside disposable, network-isolated containers or VMs rather than directly on developer or CI hosts until vendor guidance is published
  • Disable or tightly scope any 'external control' or plugin/tool-invocation feature in AI coding agents that allows the agent to trigger actions outside its own process (the abused primitive in the OpenAI Codex demonstration)
  • Apply defense-in-depth mitigations (application allow-listing, EDR behavioral rules, restricted PowerShell/script execution) on Windows 11 and RHEL hosts pending the integer-overflow and use-after-free patches

Longer-term hardening

  • Establish an internal review process for granting AI coding agents host-level permissions (shell exec, package installation, credential access) modeled on least-privilege service-account design, not developer convenience
  • Require sandbox/permission-boundary crossing tests as part of AI agent tool onboarding, mirroring ZDI's Coding Agent category rules (agent must not be able to affect state outside its declared task scope)
  • Adopt hypervisor and virtualization-platform patch SLAs that account for cross-tenant code-execution severity, given the $200,000 ESXi payout reflects real-world blast radius in multi-tenant cloud/hosting environments
  • Build detection content for anomalous AI-agent behavior (mass Shodan-style target enumeration, exploitation of scanned CVEs, credential harvesting, and 'monetization report' generation) consistent with the documented real-world abuse pattern

Weaknesses (CWE) in Pwn2Own Berlin 2026 Day Three

CWE-416, CWE-457, CWE-190, CWE-787, CWE-269, CWE-284

Timeline of Pwn2Own Berlin 2026 Day Three

  • ZDI's Dustin Childs discloses a 450% year-over-year surge in Pwn2Own Berlin 2026 submissions, attributed to researchers using AI tools to both find bugs and draft registration documentation; ZDI deploys agentic-AI triage to filter nearly 100 last-72-hour entries down to a reviewable set, rejecting 150+ working zero-day chains for the first time in the event's 19-year history.
  • Pwn2Own Berlin 2026 Day One: 22 entries, 24 unique zero-days demonstrated, $523,000 paid; Orange Tsai (DEVCORE) chains four logic bugs to escape the Microsoft Edge sandbox ($175,000/17.5 pts); Valentina Palmiotti (IBM X-Force) wins $50,000 on an NVIDIA Container Toolkit 0-day and $20,000 rooting Red Hat Linux for Workstations; k3vg3n chains SSRF plus code injection against LiteLLM for $40,000/4 pts; first AI-product falls of the contest reported.
  • Pwn2Own Berlin 2026 Day Two: 15 additional unique zero-days, $385,750 paid, running total crosses $900K; Cheng-Da Tsai/Orange Tsai (DEVCORE) chains three bugs for unauthenticated RCE as SYSTEM against Microsoft Exchange ($200,000); Siyeon Wi escalates privileges on Windows 11 via integer overflow ($7,500/3 pts); Ben Koo (Team DDOS) roots Red Hat Enterprise Linux for Workstations ($10,000).
  • Pwn2Own Berlin 2026 concludes: 47 unique zero-days, $1,298,250 total payout (up ~20% year-over-year from $1,078,750). DEVCORE Research Team is crowned Master of Pwn with 50.5 points/$505,000; STARLabs SG takes 2nd (25 pts/$242,500) and Out Of Bounds 3rd (12.75 pts/$95,750).
  • Byung Young Yi (Out Of Bounds) independently reproduces a previously disclosed Anthropic Claude Code bug, earning a second partial-credit collision award of $20,000 and 2 points.
  • Compass Security (Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller) triggers a one-vulnerability collision against Anthropic Claude Code with a bug from an earlier attempt, earning partial-credit $20,000 and 2 points.
  • Satoki Tsuji (Ikotas Labs) abuses an external control/permission-boundary flaw in OpenAI Codex to trigger unintended behavior and spawn multiple calculator instances, earning $20,000 and 4 points — the third successful Codex compromise of the event.
  • Sina Kheirkhah (Summoning Team) scores a partial-credit collision against Red Hat Linux, one bug previously known, earning $7,000 and 1.5 points; teammate Giuseppe Cali's separate VMware ESXi attempt times out with no award.
  • Hyunwoo Kim chains a use-after-free with an uninitialized-memory read to escalate privileges on Red Hat Enterprise Linux for Workstations, earning $5,000 and 2 points.
  • Le Tran Hai Tung, dungnm, and hieuvd (Viettel Cyber Security) use an integer overflow to escalate privileges on Windows 11, the event's fifth successful round against that target, earning $7,500 and 3 points.
  • splitline (DEVCORE Research Team) chains two vulnerabilities to achieve exploitation of Microsoft SharePoint, earning $100,000 and 10 Master of Pwn points.
  • Nguyen Hoang Thach (STARLabs SG) chains a VMware ESXi memory-corruption bug with the Cross-tenant Code Execution add-on objective, earning the contest's largest single payout of $200,000 and 20 Master of Pwn points.
  • ZDI's standard coordinated-disclosure clock begins for all 47 Pwn2Own Berlin 2026 findings; vendors (VMware/Broadcom, Microsoft, Red Hat, Anthropic, OpenAI, NVIDIA) have 90 days to ship fixes before technical write-ups and CVE identifiers become public.
  • OALABS Research publishes analysis of an unrelated real-world intrusion set showing an attacker in Addis Ababa using stolen Claude and Codex agent access, framed as 'authorized red-team' prompts, to autonomously enumerate, exploit (including CVE-2025-54068 and CVE-2025-5777), and monetize compromised infrastructure across 14+ companies — corroborating the Pwn2Own Coding Agent category's finding that AI-agent trust-boundary weaknesses generalize beyond the contest.

Sources cited for Pwn2Own Berlin 2026 Day Three

Threats related to Pwn2Own Berlin 2026 Day Three

Detection coverage for TL-2026-1546

As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1546 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats