{"id":12933,"date":"2026-05-17T10:03:39","date_gmt":"2026-05-17T10:03:39","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/05\/17\/microsoft-exchange-windows-11-and-cursor-zero-days-exploited-on-pwn2own-day-2\/"},"modified":"2026-05-17T10:03:39","modified_gmt":"2026-05-17T10:03:39","slug":"microsoft-exchange-windows-11-and-cursor-zero-days-exploited-on-pwn2own-day-2","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/05\/17\/microsoft-exchange-windows-11-and-cursor-zero-days-exploited-on-pwn2own-day-2\/","title":{"rendered":"Microsoft Exchange, Windows 11, and Cursor Zero-Days Exploited on Pwn2Own Day 2"},"content":{"rendered":"

Microsoft Exchange, Windows 11, and Cursor Zero-Days Exploited on Pwn2Own Day 2
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Pwn2Own Berlin 2026 is rapidly escalating into one of the most intense offensive security contests in recent years, with Day Two delivering a fresh wave of critical zero-day exploits targeting enterprise software, AI tools, and operating systems. <\/p>\n

Security researchers demonstrated real-world attack scenarios against high-value targets, including Microsoft Exchange<\/a>, Windows 11<\/a>, and AI coding platforms, highlighting the growing attack surface in modern environments.<\/p>\n

Following a strong opening day<\/a>, the second day added\u00a0$385,750 in rewards for 15 new zero-day vulnerabilities, pushing the total to\u00a0$908,750 and 39 unique bugs\u00a0discovered so far. DEVCORE continues to dominate the leaderboard, largely due to a high-impact Microsoft Exchange compromise.<\/p>\n

Microsoft Exchange RCE Steals the Spotlight<\/strong><\/h2>\n

The most significant exploit of the day came from\u00a0Orange Tsai of DEVCORE, who chained three vulnerabilities to achieve\u00a0remote code execution (RCE) with SYSTEM privileges on Microsoft Exchange, as reported by Zero Day Initiative<\/a>. <\/p>\n

\"Microsoft
Microsoft Exchange Exploited (Source: Zero Day Initiative)<\/figcaption><\/figure>\n

This full-chain attack earned\u00a0$200,000 and 20 Master of Pwn points, making it the highest-value exploit of the event so far.<\/p>\n

This type of attack is particularly dangerous because Exchange servers often sit at the core of enterprise communication. A successful RCE allows attackers to control email infrastructure fully, potentially enabling espionage, lateral movement, and data exfiltration.<\/p>\n

For example, in a real-world scenario, an attacker exploiting Exchange could silently access internal emails, deploy malware, or impersonate executives in phishing campaigns.<\/p>\n

Windows 11 and Linux Privilege Escalations<\/strong><\/h2>\n

Operating systems were also heavily targeted.\u00a0Siyeon Wi successfully exploited an integer overflow vulnerability in Windows 11, gaining elevated privileges and earning\u00a0$7,500. <\/p>\n

\"Windows
Windows 11 Exploited (Source: Zero Day Initative)<\/figcaption><\/figure>\n

While smaller in payout, such bugs are critical because they can turn limited access into full system control.<\/p>\n

On the Linux side,\u00a0Ben Koo of Team DDOS exploited a use-after-free flaw\u00a0to escalate privileges on Red Hat Enterprise Linux, reinforcing the fact that memory safety issues continue to plague core systems.<\/p>\n

\"Linux
Linux exploited (Source: Zero Day Initative)<\/figcaption><\/figure>\n

AI and developer-focused tools emerged as major targets this year. Notably:<\/p>\n