By Abinaya
Publication Date: 2026-10-21 09:39:00
Microsoft has introduced a new report-assessment system across its bug bounty programs, making the evidence security researchers submit a key factor in their rewards.
Under the Azure bounty program, eligible critical remote code execution and privilege escalation reports can earn $40,000 when assessed as Complete, compared with $4,000 when marked Not Complete.
The change applies to reports submitted from October 20, 2026, at 8 AM Pacific Time. Earlier submissions remain subject to the previous report quality requirements.
Microsoft says the update aims to reduce requests for missing details and help its security teams reproduce and assess vulnerabilities faster.
The $40,000 figure is not a standard payment for every Azure vulnerability. Microsoft’s Azure Bounty Program ties awards to security impact, severity, and report completeness.
Microsoft Offers $40,000 for Complete Azure Vulnerability Reports
Critical information disclosure reports carry general awards…