Microsoft Offers $40,000 for Complete Azure Vulnerability Reports, Just $4,000 for Incomplete Ones

What happened?

Microsoft has introduced a new report-assessment system across its bug bounty programs, making the evidence security researchers submit a key factor in their rewards. Under the Azure bounty program, eligible critical remote code execution and privilege escalation reports can earn $40,000 when assessed as Complete, compared with $4,000 when marked Not Complete. The change applies to reports submitted from October 20, 2026, at 8 AM Pacific Time. Earlier submissions remain subject to the previous report quality requirements.

Key details

• Complete critical remote code execution and privilege escalation reports in Azure can earn $40,000 versus $4,000 for incomplete ones.
• The new assessment applies to reports submitted from October 20, 2026, at 8 AM Pacific Time.
• Critical information disclosure reports pay $12,000 when complete and $1,200 when incomplete.
• Important remote code execution reports can receive $30,000 when complete against $3,000 when incomplete.
• A complete report does not guarantee payment or critical severity; Microsoft assesses impact separately.
• Researchers must provide clear reproduction steps, reliable proof of concept, vulnerability type, and accurate technical analysis.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.