# Pwn2Own Berlin 2026 Day Three: Zero-Days Demonstrated in VMware ESXi, Microsoft SharePoint, Windows 11, Red Hat Linux, and Anthropic Claude Code

> At Pwn2Own Berlin 2026 (OffensiveCon, May 14-16, 2026), competing research teams demonstrated 47 unique zero-day exploit chains for a record $1,298,250 payout, including a $200,000 VMware ESXi cross-tenant memory-corruption exploit, a $100,000 two-bug Microsoft SharePoint chain, Windows 11 and Red Hat Enterprise Linux privilege-escalation chains, and repeated compromises of a new 'Coding Agent' category covering Anthropic Claude Code, OpenAI Codex, and Cursor. DEVCORE Research Team won Master of Pwn overall with $505,000; vendors have not yet published patches and ZDI withholds full technical detail under its 90-day coordinated-disclosure timeline.

- **Published:** 2026-07-19T00:00:00Z
- **Last reviewed:** 2026-07-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1546
- **ID:** TL-2026-1546
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Pwn2Own Berlin 2026, organized by Trend Micro's Zero Day Initiative (ZDI) and co-located with OffensiveCon, ran May 14-16, 2026 and closed with 47 unique zero-day vulnerabilities disclosed for a total of $1,298,250 - a roughly 20% increase over the prior year's $1,078,750. ZDI reported a 450% year-over-year surge in contest submissions, which Dustin Childs (ZDI head of threat awareness) attributed to researchers using AI coding tools both to discover bugs and to draft the documentation required for contest registration; nearly 100 entries arrived in the final 72 hours before registration closed, forcing ZDI to reject over 150 working zero-day chains for the first time in the event's 19-year history and to deploy its own agentic-AI triage pipeline to filter submissions down to a reviewable volume.

Day One (24 unique 0-days, $523,000) featured Orange Tsai (DEVCORE) chaining four logic bugs to escape the Microsoft Edge sandbox ($175,000/17.5 pts), Valentina Palmiotti (IBM X-Force) rooting an NVIDIA Container Toolkit 0-day ($50,000) and Red Hat Linux for Workstations ($20,000), and k3vg3n chaining SSRF plus code injection to exploit LiteLLM ($40,000/4 pts). Day Two (15 unique 0-days, $385,750, running total $908,750) featured Cheng-Da Tsai/Orange Tsai (DEVCORE) chaining three bugs for unauthenticated remote code execution as SYSTEM against Microsoft Exchange ($200,000), Siyeon Wi escalating privileges on Windows 11 via integer overflow ($7,500/3 pts), and Ben Koo (Team DDOS) rooting Red Hat Enterprise Linux for Workstations ($10,000).

Day Three (final day, bringing the contest to $1,298,250 / 47 zero-days) delivered the highest single payout of the event: Nguyen Hoang Thach of STARLabs SG chained a memory-corruption bug in VMware ESXi with the contest's Cross-tenant Code Execution add-on objective for $200,000 and 20 Master of Pwn points - a hypervisor escape with direct cross-tenant blast radius in shared virtualization environments. splitline of DEVCORE Research Team chained two distinct bugs to achieve exploitation of Microsoft SharePoint for $100,000 and 10 points. Le Tran Hai Tung, dungnm, and hieuvd of Viettel Cyber Security used an integer overflow to escalate privileges on Windows 11 in the event's fifth successful round against that target, earning $7,500 and 3 points. Hyunwoo Kim chained a use-after-free with an uninitialized-memory read to escalate privileges on Red Hat Enterprise Linux for Workstations, earning $5,000 and 2 points. Sina Kheirkhah of Summoning Team scored a partial-credit collision against Red Hat Linux (one bug previously known) for $7,000 and 1.5 points, while a teammate, Giuseppe Cali, timed out attempting a separate VMware ESXi entry.

The contest's newly introduced 'Coding Agent' category - covering Anthropic Claude Code, OpenAI Codex, and Cursor - drew sustained attention across all three days as ZDI required exploits to originate from realistic coding-agent use cases and to cross a sandbox or permission boundary (i.e., achieve impact beyond the agent's intended blast radius, such as host code execution or unauthorized external control). Satoki Tsuji of Ikotas Labs abused an external control/permission-boundary flaw in OpenAI Codex to trigger unintended behavior and spawn multiple calculator instances (a canonical PoC-of-concept RCE demonstration), earning $20,000 and 4 points - the third successful Codex compromise of the event. Anthropic Claude Code was hit twice on Day Three, both as partial-credit collisions rather than fresh zero-days: a five-person Compass Security team (Emanuele Barbeno, Cyrill Bannwart, Yves Bieri, Lukasz D., Urs Mueller) triggered a one-vulnerability collision with a bug from an earlier attempt, and Byung Young Yi of Out Of Bounds independently reproduced a previously disclosed Claude Code bug; each collision still paid $20,000 and 2 Master of Pwn points under ZDI's partial-credit rules. Analysis from Trend Micro and independent researchers characterized the AI coding-agent category's root causes as consistent across all three targeted products: overpowered underlying developer tooling (broad filesystem/shell/network access granted to the agent runtime) and misplaced trust boundaries between the agent, its host permissions, and the user-supplied task - the same class of weakness abused in real-world incidents where attackers wrap malicious instructions as 'authorized red-team' prompts to get Claude/Codex-class agents to autonomously enumerate, exploit, and monetize compromised infrastructure.

No CVE identifiers, CVSS scores, or public proof-of-concept code have been published for any Pwn2Own Berlin 2026 finding as of this writing. Per ZDI's standard coordinated-disclosure process, all 47 vulnerabilities were privately reported to the affected vendors (VMware/Broadcom, Microsoft, Red Hat, Anthropic, OpenAI, NVIDIA, Mozilla, and others) with a 90-day window before technical write-ups and CVE assignment become public; researchers and defenders should treat every named product/version as pending-disclosure and monitor vendor advisories and the ZDI upcoming-advisories list for the associated CVEs.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1195 Supply Chain Compromise
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1068 Exploitation for Privilege Escalation
- T1611 Escape to Host
- T1548 Abuse Elevation Control Mechanism
- T1211 Exploitation for Stealth
- T1610 Deploy Container
- T1685 Disable or Modify Tools
- T1518 Software Discovery
- T1046 Network Service Discovery
- T1580 Cloud Infrastructure Discovery
- T1003 OS Credential Dumping
- T1552 Unsecured Credentials
- T1210 Exploitation of Remote Services
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1489 Service Stop
- T1587 Develop Capabilities
- T1595 Active Scanning

## Sources

- [Pwn2Own Berlin 2026 - Day Three Results and Master of Pwn](https://www.thezdi.com/blog/2026/5/16/pwn2own-berlin-2026-day-three-results-and-master-of-pwn)
- [Pwn2Own Berlin 2026, Day Three: DEVCORE Crowned Master of Pwn, $1.298 Million Total](https://securityaffairs.com/192250/hacking/pwn2own-berlin-2026-day-three-devcore-crowned-master-of-pwn-1-298-million-total.html)
- [Pwn2Own Berlin 2026 concludes with $1.29 million paid for 47 zero-days](https://cyberinsider.com/pwn2own-berlin-2026-concludes-with-1-29-million-paid-for-47-zero-days/)
- [Pwn2Own Berlin 2026, 47 Zero-Days and the New AI Toolchain Attack Surface](https://www.penligent.ai/hackinglabs/pwn2own-berlin-2026-47-zero-days/)
- [Pwn2Own Berlin 2026: AI Broke the Contest Built to Test It](https://securitypointbreak.com/2026/05/14/pwn2own-berlin-2026-zdi-ai-submissions-surge-rejected-researchers/)
- [Pwn2Own Berlin 2026 Results: DEVCORE Wins Master of Pwn, $1.3M Paid for 47 Zero-Days](https://securitypointbreak.com/2026/05/18/pwn2own-berlin-2026-results-devcore-master-of-pwn/)
- [GenAI Is Both Hunter and Hunted at Pwn2Own Berlin 2026](https://www.trendmicro.com/en_us/research/26/f/pwn2own-genai.html)
- [Zero Day Initiative - Pwn2Own Berlin 2026 - Day Two Results](https://www.zerodayinitiative.com/blog/2026/5/15/pwn2own-berlin-2026-day-two-results)
- [Pwn2Own Berlin 2026, Day Two: $385,750 more, Microsoft Exchange falls, and the running total crosses $900K](https://securityaffairs.com/192209/security/pwn2own-berlin-2026-day-two-385750-more-microsoft-exchange-falls-and-the-running-total-crosses-900k.html)
- [Pwn2Own Berlin 2026, Day One: $523,000 paid out, AI products fall](https://securityaffairs.com/192183/hacking/pwn2own-berlin-2026-day-one-523000-paid-out-ai-products-fall.html)
- [Hackers earn $1,298,250 for 47 zero-days at Pwn2Own Berlin 2026](https://www.bleepingcomputer.com/news/security/hackers-earn-1-298-250-for-47-zero-days-at-pwn2own-berlin-2026/)
- [Captured Logs Reveal Hackers Using Claude and Codex to Breach Companies](https://research.openanalysis.net/claude/codex/hacking/ai%20hacking/llm/redteam/policy%20violation/2026/06/16/compromised-claude-hacking.html)
- [Pwn2Own Berlin 2026: On the Ground with ZDI's Biggest AI Showdown Yet](https://www.trendmicro.com/ru_ru/research/26/f/pwn2own-berlin-2026.html)
- [Pwn2Own Berlin 2026 day two: Exchange, Windows 11, and AI tooling fall to fresh zero-days](https://blog.toolslib.net/2026/05/17/pwn2own-berlin-2026-day-two-exchange-windows11-ai-zero-days/)
- [Pwn2Own Berlin 2026 Closes With $1.3 Million in Zero-Day Payouts](https://hackread.com/pwn2own-berlin-2026-closes-zero-day-payouts/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1546