Security Experts:

Connect with us

Hi, what are you looking for?


Cloud Security

Microsoft Launches Windows Bug Bounty Program

Microsoft announced on Wednesday the launch of a Windows bug bounty program with payouts ranging between $500 and $250,000.

Microsoft announced on Wednesday the launch of a Windows bug bounty program with payouts ranging between $500 and $250,000.

Microsoft has been running several bug bounty programs, but none of them have covered all features of Windows. As part of the new program, the company is prepared to pay out a reward for security holes in any feature of Windows Insider Preview and various focus areas that include the Hyper-V hypervisor, exploit mitigation bypasses, the Windows Defender Application Guard, and the Edge web browser.

“Any critical or important class remote code execution, elevation of privilege, or design flaws that compromises a customer’s privacy and security will receive a bounty,” Microsoft said.

Bounty hunters can earn up to $15,000 for remote code execution, up to $10,000 for privilege escalation, and up to $5,000 for information disclosure, remote denial-of-service (DoS), and tampering or spoofing vulnerabilities found in Windows Insider Preview, the slow ring.

As for the focus areas, the newly added Windows Defender Application Guard (WDAG) category can earn researchers up to $30,000 for a high quality report and functioning exploit demonstrating a vulnerability that can be leveraged to escape the WDAG container to the host.

The highest payout is for vulnerabilities in Hyper-V running on Windows 10, Windows Server 2012 or Windows Insider Preview. Hackers can receive up to $250,000 from Microsoft for a high quality report and exploit demonstrating a remote code execution flaw that allows a guest VM to compromise the hypervisor, a guest to host escape, or a guest to guest escape.

In the other focus areas, hackers can earn up to $200,000 if they find a way to bypass exploit mitigations, and a maximum of $15,000 for remote code execution flaws in Edge.

Researchers who discover vulnerabilities already found internally by Microsoft employees will still get a reward if they are the first to submit a report. They are eligible to receive up to 10 percent of the maximum bounty amount.

Related Reading: Internet Bug Bounty Project Receives $300,000 Donation

Related Reading: Mozilla Revamps Bug Bounty Program

Related Reading: Yahoo Paid Out $2 Million in Bug Bounty Program

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Management & Strategy

Tens of cybersecurity companies have announced cutting staff over the past year, in some cases significant portions of their global workforce.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Management & Strategy

SecurityWeek examines how a layoff-induced influx of experienced professionals into the job seeker market is affecting or might affect, the skills gap and recruitment...