Pwn2Own Berlin 2026 Uncovers 47 Zero-Days Across AI and Enterprise Products
Summary
Researchers demonstrated 47 zero-days at Pwn2Own Berlin 2026, including exploits affecting AI tools, Microsoft products, and VMware ESXi. Trend Micro says it shipped nine network filters ahead of vendor patches.
Key points
- The competition reported 47 unique zero-days across ten target categories, with US$1,298,250 in payouts.
- AI targets including OpenAI Codex, LiteLLM, LM Studio, and NVIDIA Megatron Bridge were exploited through weaknesses at trust boundaries with external tools or protocols.
- Demonstrations also included Exchange SYSTEM-level remote code execution, unauthenticated SharePoint remote code execution, an Edge sandbox escape, and a VMware ESXi guest-to-host escape with cross-tenant implications.
- Trend Micro reported shipping nine TippingPoint filters by May 19 for vulnerabilities affecting LiteLLM, Edge, Exchange, and SharePoint, before vendor patches.
- Vendors were given 90 days to issue patches; Trend Micro said additional detection guidance and coverage were still being evaluated.
- The article recommends layered defenses for AI tools, including network segmentation, endpoint behavioral monitoring, process-lineage alerts, and file-system integrity monitoring.
Article Details
- Event Type
- Pwn2Own Berlin 2026 vulnerability-disclosure competition, where researchers demonstrated exploits for 47 zero-day vulnerabilities across ten target categories.
- Impact
- Demonstrations included root-level code execution in OpenAI Codex and LiteLLM, attacker-controlled code execution in LM Studio and NVIDIA Megatron Bridge, SYSTEM-level remote code execution in Microsoft Exchange, unauthenticated remote code execution in Microsoft SharePoint, a Microsoft Edge sandbox escape, and a VMware ESXi guest-to-host escape with cross-tenant code execution. TrendAI reported shipping nine TippingPoint filters by May 19, 2026, covering vulnerabilities in LiteLLM, Microsoft Edge, Microsoft Exchange Server, and Microsoft SharePoint; vendors had 90 days to issue patches.
People
Nguyen Hoang ThachSTARLabs SG member who demonstrated the VMware ESXi guest-to-host escape.Orange TsaiDEVCORE Research Team member who demonstrated exploits against Microsoft Exchange and Microsoft Edge.Scott GrahamArticle author.splitlineDEVCORE Research Team contestant who demonstrated an exploit against Microsoft SharePoint.
Vendors
Amazon Web ServicesThis year, the event was co-sponsored by Amazon Web Services (AWS), a partnership that allowed TrendAI™ ZDI to offer increased rewards for bugs in Firecracker.AnthropicLiteLLMProducts including OpenAI Codex, LiteLLM, LM Studio, and NVIDIA Megatron Bridge all fell, each exploited at the boundary where the AI product unconditionally trusts an external tool or protocol (the "trust boundary"MicrosoftMicrosoft Exchange (SYSTEM RCE), SharePoint (pre-authentication RCE), and Edge (four-bug sandbox escape) all fell to well-understood vulnerability classes.NvidiaAI sub-categories (Coding Agents, Local Inference, AI Databases, NVIDIA) dominated the first day.OpenAIProducts including OpenAI Codex, LiteLLM, LM Studio, and NVIDIA Megatron Bridge all fell, each exploited at the boundary where the AI product unconditionally trusts an external tool or protocol (the "trust boundary"OracleThere were also successful attempts in a variety of other products including Claude, Cursor, NVIDIA Container Toolkit, Oracle AI Database, Windows 11, Red Hat Enterprise Linux, and more.Red HatThere were also successful attempts in a variety of other products including Claude, Cursor, NVIDIA Container Toolkit, Oracle AI Database, Windows 11, Red Hat Enterprise Linux, and more.TrendAIPwn2Own Berlin 2026: On the Ground With TrendAI™ ZDI's Biggest AI Showdown YetVMwareVMware ESXi produced a cross-tenant guest-to-host escape with multi-tenant infrastructure implications.
Products
ClaudeThere were also successful attempts in a variety of other products including Claude, Cursor, NVIDIA Container Toolkit, Oracle AI Database, Windows 11, Red Hat Enterprise Linux, and more.CursorThere were also successful attempts in a variety of other products including Claude, Cursor, NVIDIA Container Toolkit, Oracle AI Database, Windows 11, Red Hat Enterprise Linux, and more.LiteLLMProducts including OpenAI Codex, LiteLLM, LM Studio, and NVIDIA Megatron Bridge all fell, each exploited at the boundary where the AI product unconditionally trusts an external tool or protocol (the "trust boundary"LM StudioProducts including OpenAI Codex, LiteLLM, LM Studio, and NVIDIA Megatron Bridge all fell, each exploited at the boundary where the AI product unconditionally trusts an external tool or protocol (the "trust boundary"Microsoft EdgeMicrosoft Edge was targeted by the prolific Orange Tsai on the first day of the contest, chaining four logic bugs, none individually catastrophic, to achieve a full sandbox escape, earning US$175,000.Microsoft ExchangeMicrosoft Exchange (SYSTEM RCE), SharePoint (pre-authentication RCE), and Edge (four-bug sandbox escape) all fell to well-understood vulnerability classes.Microsoft SharePointMicrosoft SharePoint was compromised by splitline of DEVCORE Research Team, earning US$100,000.Nvidia Container ToolkitThere were also successful attempts in a variety of other products including Claude, Cursor, NVIDIA Container Toolkit, Oracle AI Database, Windows 11, Red Hat Enterprise Linux, and more.NVIDIA Megatron BridgeProducts including OpenAI Codex, LiteLLM, LM Studio, and NVIDIA Megatron Bridge all fell, each exploited at the boundary where the AI product unconditionally trusts an external tool or protocol (the "trust boundary"OpenAI CodexProducts including OpenAI Codex, LiteLLM, LM Studio, and NVIDIA Megatron Bridge all fell, each exploited at the boundary where the AI product unconditionally trusts an external tool or protocol (the "trust boundary"Oracle AI DatabaseThere were also successful attempts in a variety of other products including Claude, Cursor, NVIDIA Container Toolkit, Oracle AI Database, Windows 11, Red Hat Enterprise Linux, and more.Red Hat Enterprise LinuxThere were also successful attempts in a variety of other products including Claude, Cursor, NVIDIA Container Toolkit, Oracle AI Database, Windows 11, Red Hat Enterprise Linux, and more.TrendAI TippingPointTrendAI Vision OneEndpoint-layer detection via TrendAI Vision One™ is the recommended control for AI-category vulnerabilities where wire-level inspection is not viable.TrendAI Vision One Cloud IPSTrendAI Vision One Endpoint SecurityTrendAI Vision One Server and Workload Security (SWP)TrendAI Vision One XDR for NetworksVMware ESXiVMware ESXi produced a cross-tenant guest-to-host escape with multi-tenant infrastructure implications.Windows 11There were also successful attempts in a variety of other products including Claude, Cursor, NVIDIA Container Toolkit, Oracle AI Database, Windows 11, Red Hat Enterprise Linux, and more.