Bitdefender bug bounty programs
bitdefender.com Updated
Bitdefender runs three public programs: a Bugcrowd bug bounty paying up to $15,000, a Bugcrowd bug bounty paying up to $5,000 and a self-hosted disclosure program with no cash rewards.
- Top reward
- $15,000
- Bugcrowd
- Programs
- 3
- 2 pay cash
- Targets in scope
- 15
- 4 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
3 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Bitdefender
Bugcrowd · Pays the most of the 3 programs: up to $15,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Bitdefender
Bugcrowd · Bug bounty |
$15k (highest) | $5,000 (highest) | $1,000 (highest) | $500 (highest) | $15,000 | Full | – | – | Open |
|
Bitdefender Box v2
Bugcrowd · Bug bounty |
$5,000 | $2,500 | $1,000 | $500 | $5,000 | Full | – | – | Open |
|
Bitdefender
Self-hosted · Disclosure only |
– | – | – | – | No cash | – | – | – | Open |
-
- Critical
- $15k (highest)
- High
- $5,000 (highest)
- Medium
- $1,000 (highest)
- Low
- $500 (highest)
- Safe harbor
- Full
-
- Critical
- $5,000
- High
- $2,500
- Medium
- $1,000
- Low
- $500
- Safe harbor
- Full
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
15 targets across all 3 programs, each listed once with the programs that cover it. 27 excluded.
-
https://www.bitdefender.com/business/smb-products/business-security.html?cid=ppc|b|google|smb&s_kwcid=AL!6076!3!514235572261!p!!g!!bitdefender%20business&utm_term=bitdefender%20business&utm_campaign=USA+SMB+Branded+30&utm_source=adwords&utm_medium=ppc&hsa_acc=8155205354&hsa_cam=7848657822&hsa_grp=124745713150&hsa_ad=514235572261&hsa_src=g&hsa_tgt=kwd-308396066873&hsa_kw=bitdefender%20business&hsa_mt=p&hsa_net=adwords&hsa_ver=3&gclid=CjwKCAjwqIiFBhAHEiwANg9szk-Rr3iSn4mrwsvAUOn-pzrO12ufWDmyCLopWigaLQW0t_xtlBE65RoCr6kQAvD_BwE
Products and areas
Covered by Bitdefender
No target matches. Try part of a host name, such as the company name.
Out of scope 27
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
brand.bitdefender.com
Bitdefender
-
businessemail.bitdefender.com
Bitdefender
-
businessinsights.bitdefender.com
Bitdefender
-
businessresources.bitdefender.com
Bitdefender
-
central.bitdefender.com
Bitdefender Box v2
-
community.bitdefender.com
Bitdefender
-
crp.bitdefender.com
Bitdefender
-
demo.bitdefender.com
Bitdefender
-
explore-lb.bitdefender.com
Bitdefender
-
explore.bitdefender.com
Bitdefender
-
lsems.gravityzone.bitdefender.com
Bitdefender
-
oemhub.bitdefender.com
Bitdefender
-
oemresources.bitdefender.com
Bitdefender
-
partner-marketing.bitdefender.com
Bitdefender
-
resellerportal.bitdefender.com
Bitdefender
-
seems.gravityzone.bitdefender.com
Bitdefender
-
ssems.gravityzone.bitdefender.com
Bitdefender
-
sstats.bitdefender.com
Bitdefender
-
stats.bitdefender.com
Bitdefender
-
telcosuccess.bitdefender.com
Bitdefender
-
translate.bitdefender.com
Bitdefender
-
trust.bitdefender.com
Bitdefender
-
workflow-dev.bitdefender.com
Bitdefender
-
workflow-test.bitdefender.com
Bitdefender
-
workflow.bitdefender.com
Bitdefender
-
Bitdefender Central (Android App)
Bitdefender Box v2
-
Bitdefender Central (iOS App)
Bitdefender Box v2
Recent changes
Reward and scope changes across every Bitdefender program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Bitdefender products, from the NVD.
-
CVE-2026-6851 High
An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links. This issue affects Total Security: before 27.0.58.315; Internet Security: before 27.0.58.315.
-
CVE-2026-6851 High
An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links. This issue affects Total Security: before 27.0.58.315; Internet Security: before 27.0.58.315.
-
CVE-2026-6851 High
An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links. This issue affects Total Security: before 27.0.58.315; Internet Security: before 27.0.58.315.
-
CVE-2026-10046 High
Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/guests/bios_handlers.c. The handler computes a destination offset into the guest RealModeMemory buffer from guest-controlled ES and EDI register values without validating that the resulting address remains within the 1MB RealModeMemory allocat
-
CVE-2026-10046 High
Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/guests/bios_handlers.c. The handler computes a destination offset into the guest RealModeMemory buffer from guest-controlled ES and EDI register values without validating that the resulting address remains within the 1MB RealModeMemory allocat
-
CVE-2026-10047 High
The Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the real-mode hook handler, implemented in napoca/kernel/handler.c. The handler uses a guest-controlled SS:SP-derived offset as an index into the 1MB RealModeMemory buffer without bounds validation. With SS=0xFFFF and ESP=0xFFFF, the computed offset can reach 0x10FFEF, exceeding the RealModeMemory buffer
-
CVE-2026-10047 High
The Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the real-mode hook handler, implemented in napoca/kernel/handler.c. The handler uses a guest-controlled SS:SP-derived offset as an index into the 1MB RealModeMemory buffer without bounds validation. With SS=0xFFFF and ESP=0xFFFF, the computed offset can reach 0x10FFEF, exceeding the RealModeMemory buffer
-
CVE-2026-10046 High
Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/guests/bios_handlers.c. The handler computes a destination offset into the guest RealModeMemory buffer from guest-controlled ES and EDI register values without validating that the resulting address remains within the 1MB RealModeMemory allocat
About this page
This page gathers every public program listed under bitdefender.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.