Microsoft products were the target of multiple successful exploits on the second day of Pwn2Own Berlin 2026. Researchers demonstrated attacks against Windows 11, Microsoft Edge, and Microsoft Exchange. The contest is organized by the Zero Day Initiative.
Researchers exploit Windows 11 and Exchange
A Windows 11 privilege escalation vulnerability was exploited via an integer overflow, earning the researcher $7,500. Orange Tsai chained three bugs to achieve remote code execution in Microsoft Exchange, winning $200,000. Multiple AI tools were also breached, including Ollama, LM Studio, Claude Desktop, Cursor, and OpenAI Codex.
Day two of the contest awarded a total of $385,750 for 15 unique zero-day exploits. Combined with day one results, the two-day total reached $908,750 for 39 exploits. On day one, Windows 11 was exploited multiple times, and Orange Tsai performed an Edge sandbox escape worth $175,000.
The Zero Day Initiative has not disclosed whether Microsoft plans to patch the vulnerabilities or when fixes might arrive.
Discussion
0 comments
Log in to join the thread with a thoughtful take, question, or correction.