Summary
Security researchers exploited 32 previously unknown zero-day vulnerabilities on the first day of Pwn2Own Ireland 2026, the annual competitive vulnerability disclosure event organized by Trend Micro’s Zero Day Initiative. The 32 zero-days spanned network-attached storage devices, routers, printers, and IP cameras from multiple major vendors. Day one awards exceeded $700,000. Pwn2Own Ireland focuses on SOHO and enterprise network device categories, and the volume of zero-days disclosed in a single day underscores the persistent vulnerability density in network-connected device firmware.
Timeline
| Date | Event |
|---|---|
| Oct 7, 2026 | Pwn2Own Ireland 2026 day one: 32 zero-days exploited across NAS, routers, printers, cameras; $700K+ awarded; BleepingComputer reports |
What Happened
Pwn2Own Ireland is the network device and IoT-focused edition of the Pwn2Own competition series, targeting the categories of connected hardware most commonly deployed in enterprise edge environments and home offices. The 32 zero-days disclosed on day one affect devices from vendors whose products are deployed across millions of enterprise and consumer networks. Under Pwn2Own’s coordinated disclosure rules, affected vendors are notified of the vulnerabilities at the time of exploitation and given a fixed window to release patches before full technical details are published.
The volume of zero-days in a single competition day is significant for two reasons. First, it demonstrates that the attack surface of network-connected devices remains densely populated with exploitable vulnerabilities despite years of vendor security investment. Second, Pwn2Own disclosures have historically been followed within weeks by exploitation of the same vulnerabilities by threat actors who reverse-engineer patches or independently discover the same issues. Organizations should monitor vendor patch releases following Pwn2Own Ireland and prioritize patching of affected NAS, router, printer, and camera models.
Note on Domain Intelligence
Pwn2Own Ireland is a research competition. No single victim domain is the primary subject of this bulletin.