Thales bug bounty programs
thalesgroup.com Updated
Thales runs one public program: a Bugcrowd bug bounty paying up to $2,500.
- Top reward
- $2,500
- Bugcrowd
- Programs
- 1
- 1 pays cash
- Targets in scope
- 8
- 5 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Thales runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Thales Cyber Security Products Bug Bounty
Bugcrowd · Bug bounty |
$2,500 | $1,250 | $600 | $200 | $2,500 | Full | – | – | Open |
-
- Critical
- $2,500
- High
- $1,250
- Medium
- $600
- Low
- $200
- Safe harbor
- Full
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
8 targets. 2 excluded.
-
*.imperva.com
Wildcards
-
www.cloudvector.com
Domains
-
https://cpl.thalesgroup.com
Web
-
https://supportportal.thalesgroup.com
Web
-
https://www.imperva.com
Web
-
https://*.incapsula.com
APIs
-
https://bugcrowd.com/engagements/imperva-mbb
Products and areas
-
PTaaS Reference
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 2
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
docs-be.imperva.com
-
docs.imperva.com
Recent changes
Reward and scope changes across every Thales program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Thales products, from the NVD.
-
CVE-2026-6805 Medium
Vulnerability on the external sharing feature in Cryptobox allows an attacker knowing a sharing link URL to retrieve information from the server allowing an offline brute-force attack of the access code associated to this sharing link.
-
CVE-2024-5264 Medium
Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis
-
CVE-2024-0197 High
A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access.
-
CVE-2023-7016 High
A flaw in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to execute code at a SYSTEM level via local access.
-
CVE-2023-5993 High
A flaw in the Windows Installer in Thales SafeNet Authentication Client prior to 10.8 R10 on Windows allows an attacker to escalate their privilege level via local access.
-
CVE-2023-2737 Medium
Improper log permissions in SafeNet Authentication Service Version 3.4.0 on Windows allows an authenticated attacker to cause a denial of service via local privilege escalation.
-
CVE-2022-1293 Medium
The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions.
-
CVE-2021-42056 Medium
Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, through a symlink attack, to overwrite arbitrary files, and potentially achieve arbitrary command execution with high privileges.
About this page
This page gathers every public program listed under thalesgroup.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.