Microsoft announced on Friday that it’s offering rewards of up to $15,000 for serious vulnerabilities found in Nano Server.
Nano Server, a new installation option available in Windows Server 2016, is a remotely administered server operating system designed for datacenters and private clouds. Nano Server is small, fast and requires fewer updates and restarts compared to Windows Server.
Microsoft says the product is ideal as a compute host for Hyper-V virtual machines, as a storage host for Scale-Out File Server, as a DNS server, or as a host for cloud apps running in a container or a VM.
The company is prepared to pay between $500 and $15,000 for vulnerabilities found in the Nano Server installation option of Windows Server 2016 Technical Preview 5 and all subsequent releases.
The bug bounty will be running for a period of three months, until July 29. The goal is to find security holes while the product is still in technical preview in an effort to minimize impact on customers after it becomes generally available.
Bug bounty hunters can earn $15,000 if they submit a high quality report and a proof-of-concept (PoC) demonstrating a remote code execution (RCE) vulnerability in Nano Server. A high quality report describing remote, unauthenticated denial-of-service (DoS), privilege escalation, or other high severity flaws in specific Nano Server DLLs can earn researchers up to $9,000.
“Important” vulnerabilities found in Nano Server DLLs, such as spoofing and information disclosure issues, are worth $500.
Microsoft pointed out that a flaw is not eligible for a reward if it’s found in versions of Nano Server earlier than Technical Preview 5, if it’s in user-generated content, and if exploitation requires admin privileges or extensive user actions.
This is not the first temporary bug bounty run by Microsoft. Last year, the company ran a two-month program for technical preview versions of the Edge web browser and a three-month program for CoreCLR and beta versions of ASP.NET.
In March, Microsoft announced that it had added OneDrive to the company’s Online Services Bug Bounty Program, with rewards ranging between $500 and $15,000.
Related: Microsoft Pays $24,000 for Authentication Flaw in Live.com
Related: Researcher Gets $13,000 for Microsoft Authentication Flaw
