Threat reportVulnerabilityTL-2026-4934
Pwn2Own Berlin 2026: 47 Zero-Days Demonstrated Against VMware ESXi, Microsoft SharePoint and Exchange, Windows 11, Red Hat Linux, OpenAI Codex and Claude Code
Pwn2Own Berlin 2026 (TL-2026-4934), also tracked as Pwn2Own Berlin 2026, is a high-severity software vulnerability, first published 2026-10-31. It has no confirmed attribution, affects VMware (Broadcom) ESXi, maps to 4 MITRE ATT&CK techniques (T1059, T1190, T1203), and is covered by 9 detection rules and 17 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-4934
- Threat ID
- TL-2026-4934
- Also known as
- Pwn2Own Berlin 2026
- Severity
- HIGH
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, enterprise it, government administration, software development, cloud
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in Pwn2Own Berlin 2026
Malware and tooling: Anthropic Claude Code, LiteLLM, OpenAI Codex
How Pwn2Own Berlin 2026 works
Pwn2Own Berlin 2026 (OffensiveCon, May 14-16) awarded $1,298,250 for 47 unique zero-day vulnerabilities, including live exploits against VMware ESXi, Microsoft SharePoint and Exchange, Windows 11, Red Hat Enterprise Linux and AI coding tools. DEVCORE won Master of Pwn with 50.5 points and $505,000. These are contest demonstrations under 90-day coordinated disclosure, not in-the-wild exploitation.
Pwn2Own Berlin 2026, run by Trend Micro's Zero Day Initiative (ZDI) at OffensiveCon, paid $1,298,250 for 47 unique zero-day vulnerabilities over three days (May 14-16, 2026), about 20% above the prior year's $1,078,750. Day one paid $523,000 for 24 zero-days, day two $385,750 for 15 and day three $389,500 for 8. Targets spanned web browsers, enterprise servers, operating systems, virtualization, container tooling and a large AI/LLM category.
Day three (the subject of the ZDI post that triggered this record) had ten attempts. Nguyen Hoang Thach (STARLabs SG) used a memory corruption bug against VMware ESXi, reported with cross-tenant code execution capability, for $200,000 and 20 Master of Pwn points. splitline (DEVCORE) chained two bugs against Microsoft SharePoint for $100,000 and 10 points, after the SharePoint attempt failed on day two. Viettel Cyber Security (Le Tran Hai Tung, dungnm, hieuvd) exploited a Windows 11 integer overflow for $7,500. Hyunwoo Kim used a use-after-free plus uninitialized memory chain against Red Hat Enterprise Linux for Workstations for $5,000. Satoki Tsuji (Ikotas Labs) exploited OpenAI Codex through an External Control Abuse bug for $20,000. Sina Kheirkhah's Red Hat Linux entry was a partial collision ($7,000). Two Anthropic Claude Code entries (Compass Security, Byung Young Yi) were collisions with previously known bugs, paid $20,000 each. Giuseppe Cali's ESXi attempt failed.
Earlier days included Orange Tsai (DEVCORE) chaining four logic bugs for a Microsoft Edge sandbox escape ($175,000) and three bugs for SYSTEM-level RCE on Microsoft Exchange ($200,000); multiple Windows 11 local privilege escalations (improper access control, heap buffer overflow, use-after-free, integer overflow); a Red Hat race condition (chompie) and use-after-free (Ben Koo); an NVIDIA Container Toolkit bug ($50,000); SSRF plus code injection chains against LiteLLM and LM Studio; path traversal and CWE-470 bugs in NVIDIA Megatron Bridge; CWE-190/CWE-362 bugs in Chroma; a CWE-150 bug in OpenAI Codex; and two Cursor exploits.
Per ZDI rules, vendors receive 90 days to ship fixes before technical details are published. The sources name no CVE identifiers, CVSS scores, patch timelines or public PoC. Severity HIGH is an analyst judgment based on target prevalence and payouts. Defenders should expect vendor patches for ESXi, SharePoint, Exchange, Windows 11 and RHEL within the disclosure window and should prioritize them when released; until then, reduce exposure of management planes and SharePoint/Exchange, and apply least privilege to AI coding agents.
MITRE ATT&CK techniques used in TL-2026-4934
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Initial Access
T1190 Exploit Public-Facing Application
Privilege Escalation
Affected products and versions in Pwn2Own Berlin 2026
- VMware (Broadcom) — ESXi
Vulnerable versions: Version not disclosed - Microsoft — SharePoint
Vulnerable versions: Version not disclosed - Microsoft — Exchange
Vulnerable versions: Version not disclosed - Microsoft — Windows 11
Vulnerable versions: Version not disclosed - Microsoft — Edge
Vulnerable versions: Version not disclosed - Red Hat — Enterprise Linux (including Workstations)
Vulnerable versions: Version not disclosed - OpenAI — Codex
Vulnerable versions: Version not disclosed - Anysphere — Cursor
Vulnerable versions: Version not disclosed - NVIDIA — Container Toolkit / Megatron Bridge
Vulnerable versions: Version not disclosed - BerriAI — LiteLLM
Vulnerable versions: Version not disclosed
Remediation for Pwn2Own Berlin 2026
Patches
- No CVEs or patches are named in the sources; apply vendor patches for VMware ESXi, Microsoft SharePoint/Exchange, Windows 11, Red Hat Enterprise Linux, OpenAI Codex, Cursor and related products as they are released
Immediate actions
- Inventory ESXi, SharePoint, Exchange, Windows 11 and RHEL assets and watch vendor advisories for fixes tied to Pwn2Own Berlin 2026 submissions
- Restrict network exposure of ESXi management interfaces and on-premises SharePoint/Exchange to required users only
- Run AI coding agents (Codex, Claude Code, Cursor) with least privilege and sandboxing, and keep them updated
Workarounds
- Limit untrusted external content and tool permissions available to AI coding agents until fixes ship
- Place SharePoint and Exchange behind reverse proxies or VPN where feasible
Longer-term hardening
- Deploy EDR and behavioral detection on hypervisors, servers and developer workstations
- Segment multi-tenant virtualization environments and monitor for guest-to-host escape behavior
- Establish an SLA for applying vendor patches released after the ZDI 90-day coordinated disclosure window
Weaknesses (CWE) in Pwn2Own Berlin 2026
Timeline of Pwn2Own Berlin 2026
- ZDI publishes Day One results: $523,000 for 24 zero-days, including Orange Tsai's $175,000 Microsoft Edge sandbox escape (4 chained logic bugs)
- Pwn2Own Berlin 2026 opens at OffensiveCon with Windows 11, Red Hat, NVIDIA Container Toolkit and AI tool targets (LiteLLM, LM Studio, OpenAI Codex)
- Day Two: Orange Tsai (DEVCORE) chains 3 bugs for SYSTEM RCE on Microsoft Exchange ($200,000); Cursor exploited twice; SharePoint attempt fails; Day Two pays $385,750 for 15 zero-days
- Contest ends with $1,298,250 for 47 unique zero-days; DEVCORE wins Master of Pwn with 50.5 points and $505,000
- Day Three successes against Windows 11 (integer overflow), RHEL Workstations (use-after-free plus uninitialized memory) and OpenAI Codex (external control abuse); Claude Code entries are collisions
- splitline (DEVCORE) chains two bugs against Microsoft SharePoint for $100,000 and 10 points
- Day Three: Nguyen Hoang Thach (STARLabs SG) exploits VMware ESXi via memory corruption with cross-tenant code execution, $200,000 and 20 points
Sources cited for Pwn2Own Berlin 2026
- Pwn2Own Berlin 2026: Day Three Results and Master of Pwn (ZDI)
- Pwn2Own Berlin 2026 - Day One Results (ZDI)
- Hackers earn $1,298,250 for 47 zero-days at Pwn2Own Berlin 2026 (BleepingComputer)
- Pwn2Own Berlin 2026, Day Three: DEVCORE Crowned Master of Pwn, $1.298 Million Total (Security Affairs)
- Pwn2Own Berlin 2026, Day Two: $385,750 more, Microsoft Exchange falls (Security Affairs)
- Pwn2Own Berlin 2026 concludes with $1.29 million paid for 47 zero-days (CyberInsider)
Detection coverage for TL-2026-4934
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4934 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.