Microsoft ties Azure bounty payouts to report completeness
Original title: Microsoft Offers $40,000 for Complete Azure Vulnerability Reports, Just $4,000 for Incomplete Ones
From October 20, complete critical RCE or privilege-escalation reports can pay $40,000, versus $4,000 if incomplete.
Microsoft changed report assessment across its bug bounty programs so the evidence in the initial submission affects rewards. Under the Azure program, eligible critical remote code execution and privilege escalation reports can earn $40,000 when marked Complete and $4,000 when Not Complete. The change applies to reports submitted from October 20, 2026, at 8 AM Pacific Time; earlier submissions keep the previous quality rules. Completeness does not by itself make a finding payable or critical, and the published Azure range remains $400 to $60,000.
- Complete critical information-disclosure reports pay $12,000, versus $1,200 if incomplete.
- Critical spoofing and tampering pay $8,000 or $800 depending on completeness.
- Important remote code execution reports pay $30,000 complete or $3,000 incomplete.
- Researchers must enter steps and analysis in the MSRC Researcher Portal, not only an attachment.
From the original article
3 min read at cybersecuritynews.com
Microsoft has introduced a new report-assessment system across its bug bounty programs, making the evidence security researchers submit a key factor in their rewards. Under the Azure bounty program, eligible critical remote code execution and privilege escalation reports can earn $40,000 when assessed as Complete, compared with $4,000 when marked Not Complete. The change applies […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.