Microsoft ties Azure bounty payouts to report completeness
From October 20, complete critical RCE or privilege-escalation reports can pay $40,000, versus $4,000 if incomplete.
Stories per day · 30 days
4 stories, newest first · one card per story
Stories tagged #msrc
Microsoft ties bug bounty rewards to Complete versus Not Complete reports
Reports filed on or after October 20, 2026, at 8 AM Pacific need a PoC and exploitability details to count as Complete.
5
16-year-old researcher breaks into Microsoft analytics service with access to 17 trillion rows of data
A 16-year-old researcher bypassed JWT signature checks in Microsoft's internal Titan analytics service to gain admin and query databases holding an estimated 17.3 trillion rows.
Microsoft Offers $60,000 Bounty for Critical Cross-Tenant Vulnerabilities
Microsoft expands Dynamics 365 and Power Platform bug bounty, paying up to $60,000 for critical cross-tenant vulnerabilities.
5