Pwn2Own Berlin 2026: $908,750 Paid for 39 Zero-Days — Microsoft Exchange Falls for $200K System RCE

Pwn2Own Berlin 2026 concluded on May 15 with $908,750 awarded for 39 unique zero-day vulnerabilities — the largest single-event payout in the contest’s 18-year history. Every exploit demonstrated goes into mandatory 90-day responsible disclosure with the vendor. Patch calendars for exchange admins and AI-tooling operators just got very busy.

DEVCORE owns the leaderboard

Orange Tsai of DEVCORE Research Team headlined both major days. On Day One he earned $175,000 for chaining four logic bugs to escape Microsoft Edge’s sandbox, bypassing the renderer isolation, GPU process boundary, and elevation broker in sequence. Day Two delivered the competition’s single largest award: $200,000 for a three-bug chain achieving SYSTEM-level remote code execution on Microsoft Exchange Server. The attack entered through the Outlook Web Access endpoint, traversed a deserialization flaw in the mailbox service, and landed a shell with NT AUTHORITY\SYSTEM privileges.

For security teams, that Exchange chain is the headline. On-premises Exchange remains one of the most targeted enterprise assets globally — three of the five CVEs CISA added to its Known Exploited Vulnerabilities catalog in May 2026 originated in Exchange. A confirmed SYSTEM RCE chain demonstrated at a public event compresses the exploitation window between now and the eventual patch. Watch Microsoft’s Security Update Guide and MSRC advisories for an out-of-band fix within 30 days.

AI tooling enters the arena

Both LiteLLM and Cursor fell to demonstrated exploits in Pwn2Own’s new AI category — the first time AI infrastructure and developer tooling have appeared as official contest targets.

LiteLLM, the widely-used open-source proxy for routing calls across LLM APIs, was compromised via a server-side request forgery chain that exfiltrated API keys from the backend runtime. Cursor, the AI code editor, fell to a malicious extension achieving code execution inside the local Node.js host process. Full technical write-ups are embargoed until vendor patches ship.

The inclusion of these tools signals a recognition of where enterprise attack surface has moved. Organizations running LiteLLM as an internal LLM gateway should isolate the service from internal secrets stores now. Teams using Cursor in environments with sensitive credentials should restrict extension privileges until the host-process fix lands.

Full scoreboard

Day One: $523,000 for 24 zero-days. Day Two: $385,750 for 15. Additional targets that fell: Windows 11 (Hyper-V, kernel, print spooler chains), Red Hat Enterprise Linux, VMware vSphere, and Firefox.

Vendors have until August 13 to ship patches before ZDI publishes full technical details. For exchange admins and anyone running AI-adjacent tooling on-premises, this competition just defined the next 90 days of patch priorities.