Threat reportVulnerabilityTL-2026-3910
Pwn2Own Berlin 2026: 47 Zero-Days Disclosed Across AI Products, Exchange, SharePoint, Edge and VMware ESXi
Pwn2Own Berlin 2026 (TL-2026-3910), also tracked as Pwn2Own Berlin 2026, is a high-severity software vulnerability, first published 2026-10-19. It has no confirmed attribution, affects Microsoft Exchange Server, maps to 4 MITRE ATT&CK techniques (T1059, T1190, T1203), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-3910
- Threat ID
- TL-2026-3910
- Also known as
- Pwn2Own Berlin 2026
- Severity
- HIGH
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, health, cloud-services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
How Pwn2Own Berlin 2026 works
TrendAI Zero Day Initiative reports 47 unique zero-days demonstrated at Pwn2Own Berlin 2026 (May 14-16, OffensiveCon) for US$1,298,250 in payouts. Targets included AI coding agents, inference proxies and local LLM platforms alongside Microsoft Exchange, SharePoint, Edge, Windows 11, RHEL and VMware ESXi; vendors have 90 days to patch before technical disclosure.
Pwn2Own Berlin 2026 was run by TrendAI Zero Day Initiative (ZDI) at OffensiveCon in Berlin, sponsored by AWS. Over three days (May 14-16, 2026) researchers demonstrated 47 unique zero-day vulnerabilities for US$1,298,250, an event record; day one produced 24 zero-days and US$523,000, day two 15 zero-days and US$385,750, and day three 8 zero-days and US$389,500. DEVCORE won Master of Pwn with 50.5 points and US$505,000, followed by STARLabs SG (25 points, US$242,500) and Out of Bounds (12.75 points, US$95,750). Trend Micro's June 1, 2026 write-up notes that registration hit maximum capacity for the first time and that most contestants used AI agents as active tools when developing their exploits.
The contest introduced four AI sub-categories (AI Databases, Coding Agents, Local Inference, NVIDIA). Trend Micro characterises the dominant AI bug pattern as a trust-boundary failure: coding agents, inference proxies and local LLM platforms inherit the trust assumptions of everything they touch without validating that input reaching trusted interfaces is safe. Reported results include OpenAI Codex (three successful exploits by different teams), LiteLLM (root-level code execution via trusted interfaces, including an SSRF plus code-injection chain; three teams found distinct paths), LM Studio, NVIDIA Megatron Bridge (including an overly permissive allowlist), NVIDIA Container Toolkit (race condition), Chroma vector database, Cursor and Anthropic Claude Code.
Traditional enterprise results: Orange Tsai (DEVCORE) achieved SYSTEM-level RCE on Microsoft Exchange via a three-bug chain (US$200,000) and a full Microsoft Edge sandbox escape by chaining four logic bugs with no memory corruption (US$175,000, one-visit compromise); splitline (DEVCORE) achieved pre-authentication HTTP RCE on a default SharePoint install by chaining two bugs (US$100,000); Nguyen Hoang Thach (STARLabs SG) achieved a VMware ESXi guest-to-host escape with the cross-tenant code execution add-on via memory corruption (US$200,000). Windows 11 fell to multiple privilege-escalation zero-days (including an integer overflow) and Red Hat Enterprise Linux for Workstations to several local privilege escalations (use-after-free, uninitialized memory).
No CVE identifiers, CVSS scores, network IOCs or in-the-wild exploitation are stated in the sources; technical details are withheld by ZDI until vendors patch or the 90-day window ends. Exploitability is therefore recorded as demonstrated in a controlled contest only, with no public PoC. TrendAI shipped nine TippingPoint filters by May 19, 2026 (filters 47426-47430 and 47435-47438) covering LiteLLM, Edge, Exchange and SharePoint cases. Severity HIGH is an analyst assessment based on RCE and sandbox/VM escape classes against widely deployed software, not a source-stated rating. Patch status of individual bugs was not verified. Defenders should expect vendor patches for Exchange, SharePoint, Edge, ESXi, Windows and RHEL, and should monitor AI agent hosts for anomalous process lineage.
MITRE ATT&CK techniques used in TL-2026-3910
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Initial Access
T1190 Exploit Public-Facing Application
Privilege Escalation
Affected products and versions in Pwn2Own Berlin 2026
- Microsoft — Exchange Server
Vulnerable versions: Version not stated in source - Microsoft — SharePoint (default install)
Vulnerable versions: Version not stated in source - Microsoft — Edge
Vulnerable versions: Version not stated in source - Microsoft — Windows 11 (fully patched at time of contest)
Vulnerable versions: Version not stated in source - VMware — ESXi (with cross-tenant code execution add-on)
Vulnerable versions: Version not stated in source - Red Hat — Enterprise Linux for Workstations
Vulnerable versions: Version not stated in source - OpenAI — Codex
Vulnerable versions: Version not stated in source - BerriAI — LiteLLM
Vulnerable versions: Version not stated in source - LM Studio — LM Studio
Vulnerable versions: Version not stated in source - NVIDIA — Megatron Bridge
Vulnerable versions: Version not stated in source
Remediation for Pwn2Own Berlin 2026
Patches
- No CVE-mapped patches stated in the sources; monitor Microsoft (Exchange, SharePoint, Edge, Windows 11), Broadcom/VMware (ESXi), Red Hat (RHEL), OpenAI (Codex), LiteLLM, LM Studio and NVIDIA (Megatron Bridge, Container Toolkit) advisories
Immediate actions
- Deploy TrendAI TippingPoint filters 47426, 47427, 47428, 47429, 47430, 47435, 47436, 47437 and 47438 where TippingPoint is in use
- Alert on unexpected shell or interpreter spawns from AI coding agent, LiteLLM, LM Studio and similar inference processes (process-lineage monitoring)
- Restrict network exposure of LiteLLM proxies, local inference servers and AI agent hosts to trusted segments
Workarounds
- Limit untrusted input reaching AI agents and inference proxies; avoid running them as root
- Isolate AI tooling in containers or VMs with restricted egress
Longer-term hardening
- Apply network segmentation and least privilege around AI agents and inference infrastructure
- Enable file-system integrity monitoring on directories where AI agents have write access
- Harden hypervisors and add host-level behavioral monitoring for ESXi
- Track ZDI advisories for the affected vendors and apply patches as they ship (vendors have 90 days before technical disclosure)
Timeline of Pwn2Own Berlin 2026
- OpenAI Codex, LiteLLM, LM Studio, NVIDIA Megatron Bridge, NVIDIA Container Toolkit and Chroma are exploited on day one; three Windows 11 privilege-escalation zero-days earn US$30,000 each
- Pwn2Own Berlin 2026 day one at OffensiveCon: 22 entries, 24 unique zero-days and US$523,000 awarded; Orange Tsai chains four logic bugs for a Microsoft Edge sandbox escape (US$175,000)
- Day two adds 15 zero-days and US$385,750 (cumulative US$908,750, 39 zero-days); Orange Tsai achieves SYSTEM RCE on Microsoft Exchange via a three-bug chain (US$200,000)
- Contest closes with 47 unique zero-days and US$1,298,250 paid; DEVCORE wins Master of Pwn (50.5 points, US$505,000), STARLabs SG second, Out of Bounds third
- Final day adds 8 zero-days and US$389,500: splitline gets pre-auth RCE on SharePoint (US$100,000) and Nguyen Hoang Thach escapes VMware ESXi guest-to-host (US$200,000)
- TrendAI ships nine TippingPoint filters (47426-47430, 47435-47438) covering LiteLLM, Edge, Exchange and SharePoint ahead of vendor patches
- Trend Micro publishes its Pwn2Own Berlin 2026 analysis highlighting AI trust-boundary failures; vendors have 90 days from the demonstration before technical disclosure
Sources cited for Pwn2Own Berlin 2026
- Pwn2Own Berlin 2026: On the Ground With TrendAI ZDI's Biggest AI Showdown Yet
- Pwn2Own Berlin 2026 - Day One Results (Zero Day Initiative)
- Pwn2Own Berlin 2026, Day One: $523,000 paid out, AI products fall
- Pwn2Own Berlin 2026, Day Two: $385,750 more, Microsoft Exchange falls, and the running total crosses $900K
- Pwn2Own Berlin 2026, Day Three: DEVCORE Crowned Master of Pwn, $1.298 Million Total
Detection coverage for TL-2026-3910
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3910 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.