# Pwn2Own Berlin 2026: 47 Zero-Days Disclosed Across AI Products, Exchange, SharePoint, Edge and VMware ESXi

> TrendAI Zero Day Initiative reports 47 unique zero-days demonstrated at Pwn2Own Berlin 2026 (May 14-16, OffensiveCon) for US$1,298,250 in payouts. Targets included AI coding agents, inference proxies and local LLM platforms alongside Microsoft Exchange, SharePoint, Edge, Windows 11, RHEL and VMware ESXi; vendors have 90 days to patch before technical disclosure.

- **Published:** 2026-10-19T18:45:13Z
- **Last reviewed:** 2026-10-19T18:45:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3910
- **ID:** TL-2026-3910
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Pwn2Own Berlin 2026 was run by TrendAI Zero Day Initiative (ZDI) at OffensiveCon in Berlin, sponsored by AWS. Over three days (May 14-16, 2026) researchers demonstrated 47 unique zero-day vulnerabilities for US$1,298,250, an event record; day one produced 24 zero-days and US$523,000, day two 15 zero-days and US$385,750, and day three 8 zero-days and US$389,500. DEVCORE won Master of Pwn with 50.5 points and US$505,000, followed by STARLabs SG (25 points, US$242,500) and Out of Bounds (12.75 points, US$95,750). Trend Micro's June 1, 2026 write-up notes that registration hit maximum capacity for the first time and that most contestants used AI agents as active tools when developing their exploits.

The contest introduced four AI sub-categories (AI Databases, Coding Agents, Local Inference, NVIDIA). Trend Micro characterises the dominant AI bug pattern as a trust-boundary failure: coding agents, inference proxies and local LLM platforms inherit the trust assumptions of everything they touch without validating that input reaching trusted interfaces is safe. Reported results include OpenAI Codex (three successful exploits by different teams), LiteLLM (root-level code execution via trusted interfaces, including an SSRF plus code-injection chain; three teams found distinct paths), LM Studio, NVIDIA Megatron Bridge (including an overly permissive allowlist), NVIDIA Container Toolkit (race condition), Chroma vector database, Cursor and Anthropic Claude Code.

Traditional enterprise results: Orange Tsai (DEVCORE) achieved SYSTEM-level RCE on Microsoft Exchange via a three-bug chain (US$200,000) and a full Microsoft Edge sandbox escape by chaining four logic bugs with no memory corruption (US$175,000, one-visit compromise); splitline (DEVCORE) achieved pre-authentication HTTP RCE on a default SharePoint install by chaining two bugs (US$100,000); Nguyen Hoang Thach (STARLabs SG) achieved a VMware ESXi guest-to-host escape with the cross-tenant code execution add-on via memory corruption (US$200,000). Windows 11 fell to multiple privilege-escalation zero-days (including an integer overflow) and Red Hat Enterprise Linux for Workstations to several local privilege escalations (use-after-free, uninitialized memory).

No CVE identifiers, CVSS scores, network IOCs or in-the-wild exploitation are stated in the sources; technical details are withheld by ZDI until vendors patch or the 90-day window ends. Exploitability is therefore recorded as demonstrated in a controlled contest only, with no public PoC. TrendAI shipped nine TippingPoint filters by May 19, 2026 (filters 47426-47430 and 47435-47438) covering LiteLLM, Edge, Exchange and SharePoint cases. Severity HIGH is an analyst assessment based on RCE and sandbox/VM escape classes against widely deployed software, not a source-stated rating. Patch status of individual bugs was not verified. Defenders should expect vendor patches for Exchange, SharePoint, Edge, ESXi, Windows and RHEL, and should monitor AI agent hosts for anomalous process lineage.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1611 Escape to Host

## Sources

- [Pwn2Own Berlin 2026: On the Ground With TrendAI ZDI's Biggest AI Showdown Yet](https://www.trendmicro.com/en_us/research/26/f/pwn2own-berlin-2026.html)
- [Pwn2Own Berlin 2026 - Day One Results (Zero Day Initiative)](https://www.zerodayinitiative.com/blog/2026/5/13/pwn2own-berlin-2026-day-one-results)
- [Pwn2Own Berlin 2026, Day One: $523,000 paid out, AI products fall](https://securityaffairs.com/192183/hacking/pwn2own-berlin-2026-day-one-523000-paid-out-ai-products-fall.html)
- [Pwn2Own Berlin 2026, Day Two: $385,750 more, Microsoft Exchange falls, and the running total crosses $900K](https://securityaffairs.com/?p=192209)
- [Pwn2Own Berlin 2026, Day Three: DEVCORE Crowned Master of Pwn, $1.298 Million Total](https://securityaffairs.com/192250/hacking/pwn2own-berlin-2026-day-three-devcore-crowned-master-of-pwn-1-298-million-total.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3910