Tag

#pwn2own

1 post tagged #pwn2own.

Analysis · May 20, 2026 · Colten Anderson

A bug that won $100k at Pwn2Own in March was encrypting SharePoint by winter

The CVE-2023-29357 + CVE-2023-24955 chain gives unauthenticated RCE on SharePoint. It was demoed at Pwn2Own in March 2023, patched mid-year, had a public PoC by late 2023, and hit the KEV list in early 2024. That timeline is something you can plan around.