Cloud Software Group bug bounty programs
cloud.com Updated
Cloud Software Group runs two public programs: a Bugbase bug bounty paying up to $10,000 and a self-hosted disclosure program with no cash rewards. It also owns citrix.com, which runs one more program.
- Top reward
- $10,000
- Bugbase
- Programs
- 3
- 2 pay cash
- Targets in scope
- 23
- 7 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs Cloud Software Group runs itself, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Cloud Software Group
Bugbase · The company-wide program. Pays up to $10,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Cloud Software Group
Bugbase · Bug bounty |
$10k (highest) | $4,000 (highest) | $500 (highest) | $100 (highest) | $10,000 | – | – | – | Open |
|
Citrix
Self-hosted · Disclosure only |
– | – | – | – | No cash | None | – | 24 hours promised | Open |
-
- Critical
- $10k (highest)
- High
- $4,000 (highest)
- Medium
- $500 (highest)
- Low
- $100 (highest)
-
- Safe harbor
- None
- First response
- 24 hours promised
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
Companies Cloud Software Group owns
1 company with 1 program of its own. Each has its own scope and rules: report to the one that owns the asset.
What is in scope
23 targets across all 3 programs, each listed once with the programs that cover it. 16 excluded.
No target matches. Try part of a host name, such as the company name.
Out of scope 16
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
*.browser.cloud.com
HackerOne
-
*.citrix*.com
HackerOne
-
*.cloudburrito.com
HackerOne
-
*.podio.com
HackerOne
-
*.securevdr.com
HackerOne
-
*.xmdev.cloud.com
HackerOne
-
*.xmqa.cloud.com
HackerOne
-
*.xmtest.cloud.com
HackerOne
-
(youriwssubdomain).cloud.com
HackerOne
-
(yoursubdomain).ap.iws.cloud.com
HackerOne
-
(yoursubdomain).eu.iws.cloud.com
HackerOne
-
(yoursubdomain).us.iws.cloud.com
HackerOne
-
accounts-internal.cloud.com
HackerOne
-
citrix.cloud.com
HackerOne
-
launch.cloud.com
HackerOne
-
www.cloud.com
HackerOne
Recent changes
Reward and scope changes across every Cloud Software Group program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Cloud Software Group products, from the NVD.
-
CVE-2026-88779 High
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
-
CVE-2026-88779 High
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.
-
CVE-2026-88773 Critical
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1-37.279 and NDcPP; Gateway: before 14.1-73.37 FIPS and before 13.1-64.23.
-
CVE-2026-88774 High
Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to a feature policy bypass due to improper HTTP URL based expression usage.
-
CVE-2026-88775 High
Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
-
CVE-2026-88776 High
Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior or Denial of Service
-
CVE-2026-88777 High
Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to unpredictable or erroneous behavior or Denial of Service
-
CVE-2026-88778 High
Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23.
About this page
This page gathers every public program listed under cloud.com and the companies Cloud Software Group owns: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test. Ownership comes from settled, public acquisitions, or from a program's own text naming Cloud Software Group.
Something wrong or missing? Report a correction.