AT&T

Limited Time Promotion: Critical PHP Vulnerability Response Initiative as of 10/30 at 11 AM CDT:

For a limited 30-day window, we are seeking reports of the following critical PHP runtime vulnerabilities affecting AT&T assets: CVE-2026-109618 (Critical; CVSS v4 9.2) CVE-2026-109619 (Critical; CVSS v4 9.2) Both vulnerabilities may allow unauthenticated remote code execution on affected PHP installations.

Bounty: $100 per confirmed vulnerable instance.

Submission guidelines:

• Multiple vulnerable instances may be included in one report to help expedite review.
• Each unique affected asset or endpoint will count as a separate instance for bounty purposes.
• Include evidence demonstrating the vulnerability. Please follow the program’s testing requirements.
• Specify the PHP version and configuration details where available.
• Reference the applicable CVE in the report title and body.
• This is a time-limited program running through the end of November.

#AT&T Bug Bounty Program Policy Welcome to the AT&T Bug Bounty Program! We now use a pay per vulnerability model and utilize the HackerOne platform!

The Program encourages and rewards contributions by developers and security researchers who help make AT&T's public-facing online environment more secure. Through the Program AT&T provides monetary rewards and/or public recognition for security vulnerabilities responsibly disclosed to us.

The following explains the details of the Program. If you are new to our Program, please be sure to review the Program Guidelines, Program Exclusions, and Terms and Conditions, as well as the Reporting and Payment Process prior to making a submission.

Recent Updates:

• 10/1/26: Additional scope exclusion around API Documentation Endpoints - ArubaOS Mobility Controllers added
• 9/21/26: Many items were moved to out-of-scope. Several previously out-of-scope items were returned to scope. Please apprise yourself of these changes when submitting findings.
• 5/28/26: Vulnerabilities related to dangling or misconfigured IDE/editor extension identifiers (including VS Code, Windsurf, Cursor, or similar development environments) that could lead to extension confusion attacks are currently excluded from the program.
• The endpoint plasma.att.com (plasma-coreapi.att.com) is temporarily out of scope while AT&T performs internal updates. Reports submitted for this asset during this time will be marked as 'Informative' and will not be eligible for bounties until further notice as of Wed Mar 25 at 3:17 PM CDT.
• The following asset has been removed from scope as of 1/2/2025: SupplierGateway.
• Removed from scope as of 11/16/2021 DIRECTVLA (Vrio Corp, SKY)

#Program Guidelines The Program applies to security vulnerabilities found within AT&T's Environment, which includes, but is not limited to, AT&T’s websites, exposed APIs, mobile applications, and devices. At this time, any vulnerabilities submitted that are specific to SupplierGateway, Xandr, DIRECTVLA (Vrio Corp, SKY), WarnerMedia assets, including HBO, are out-of-scope of the AT&T program and are therefore ineligible for bounty rewards. A security vulnerability is generally an error, flaw, mistake, failure, or fault in a computer program or system that impacts the security of a device, system, network, or data. Any security vulnerability may be considered for the Program; however, it must be a new, previously unreported, vulnerability in order to be eligible for reward or recognition.

Typically, in-scope submissions will include high impact vulnerabilities. However, any vulnerability that could realistically place the online security of AT&T, our customers, or the public at large at risk is in scope and might be rewarded. Vulnerabilities which directly or indirectly affect the confidentiality or integrity of user data or privacy are prime candidates for a reward. Some characteristics that are considered when "qualifying" vulnerabilities include those that:

• Directly or indirectly affect the confidentiality or integrity of user data or privacy;
• Compromise the integrity of the system;
• Enable unauthorized access to significant data or resources;
• Enable the running of unauthorized code;
• Increase privileges or access beyond that which is intended;
• Interfere with or bypass security controls or mechanisms;
• Are exploitable (i.e. not purely theoretical);
• Can be launched remotely; and
• Could cause damage to a user's system.

#Focus Assets in scope.

• att.com/msapi
• att.com/buy/
• att.com/acctmgmt/
• myattwg.att.com/olam/
• myATT mobile apps
• signin.att.com
• identity.att.com

#Informative Reports Submissions against the following assets are accepted but are not eligible for an award and will be closed as Informative.

• Credential Stuffing
• Authorized Resellers
• Authorized Retailers
• Preferred Dealer

#Program Exclusions The following categories of vulnerabilities are excluded from reward in the Program unless otherwise directed by AT&T:

• Attacks against AT&T infrastructure;
• Social engineering and physical attacks;
• Distributed Denial of Service attacks that require large volumes of data;
• 0-day vulnerabilities less than 30/60/90 days from patch release are ineligible for bounty;
• Provisioning and/or usability issues;
• Violations of licenses or other restrictions applicable to any vendor's product;
• Security vulnerabilities in third-party products or websites that are not under AT&T’s direct control;
• Duplicate reports of security issues, including security issues that have already been identified internally;
• Tenant/cloud systems executing in an Internet Data Center (IDC), where AT&T is simply acting as the site host;
• Employee Resource Group (ERG) websites;
• Clickjacking reports against unauthenticated pages and/or static content resources;
• Reports of missing SPF records for domains with no MX record;
• Vulnerabilities that are a result of malware;
• Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited, or
• Issues determined to be low impact.
• Self-XSS involving a payload in headers or in the body of the request
• POST based Reflected XSS
• Vulnerabilities which require a social engineering component are excluded. i.e. presenting injected data to a user and expecting the user to click on an external link to complete the compromise
• Login/logout CSRF
• Content spoofing which depends on a social engineering element to succeed (such as an error page suggesting that a user take an action) is excluded
• Abandoned CNAME records require a social engineering component to successfully exploit, they are excluded unless there is an existing link from a company resource to the invalid CNAME
• Vulnerabilities related to dangling or misconfigured IDE/editor extension identifiers (including VS Code, Windsurf, Cursor, or similar development environments) that could lead to extension confusion attacks are currently excluded from the program
• Documents on Third-Party Repositories: While we appreciate submissions identifying AT&T documents or information hosted on third-party repository sites, reports will only be accepted if the researcher demonstrates a clear security impact beyond the mere presence of the documents as well as provides an attachment of the document in question. Simply discovering AT&T-related content on external platforms does not constitute a valid security vulnerability without proof of exploitable risk or actual security implications. In addition, a classification marking on a document by itself does not constitute risk or exposure. For example, very old document may no longer have any risk or exposure even though at creation time, the document was deemed necessary to require a specific classification marking. As indicated above, there needs to be a clear security impact or risk demonstrated by the researcher. Social engineering, phishing, etc. risk will not be considered significant impact
• API Documentation Endpoints - ArubaOS Mobility Controllers: Findings related to unauthenticated Swagger-UI pages hosted under /api/*.html paths on ArubaOS WiFi Mobility Controllers are excluded. These endpoints serve their intended purpose as API documentation and do not represent exploitable security vulnerabilities.

In addition, the submitter:

• Must not be the author of the code with the vulnerability or
• Must not be employed by AT&T directly or indirectly.

#Disclosure Guidance - Mutual Disclosure Only Submission of any program-related information — including resolved vulnerabilities — to anyone other than AT&T without AT&T’s prior written approval is expressly prohibited. This restriction includes public disclosures, social media posts, blog posts, presentations, interviews, conference talks, and discussions in any public or private forum. Disclosure requests will be evaluated on a case-by-case basis, and AT&T reserves the process set forthright to approve or deny any disclosure request in its sole discretion. If AT&T has not remediated a reported vulnerability within ninety (90) calendar days of the Program initial submission, the researcher may request coordinated disclosure by providing AT&T with fourteen (14) calendar days’ advance written notice. Any such coordinated disclosure must not include technical details sufficient to enable exploitation and must be coordinated with AT&T on timing and content.

** DIRECTV Assets Exclusion Notice ** Effective June 12, 2025 at 9 AM CST, all assets owned or operated by DIRECTV are no longer in scope for this bug bounty program. Any vulnerabilities discovered in DIRECTV assets should be reported directly to the DIRECTV security team at [email protected].

Please note:

• Do not submit reports related to DIRECTV assets to this AT&T program
• DIRECTV maintains a separate security process for handling vulnerability reports
• All DIRECTV-related security concerns should be directed exclusively to [email protected]

LevelBlue Assets Exclusion Notice Effective October 23, 2025 at 11:15 AM CST, all assets owned or operated by LevelBlue are no longer in scope for this bug bounty program. Any vulnerabilities discovered in LevelBlue assets should be reported directly through the LevelBlue Vulnerability Disclosure Program at https://levelblue.com/levelblue-vulnerability-disclosure-program. Any previously submitted findings will be processed as usual.

LevelBlue domains include but are not limited to:

• levelblue.com
• aveng.net
• aveng.me
• alienvault.cloud
• alienvault.us
• levelblue.cloud
• levelblue.us
• levelblue.me

Please note:

• Do not submit reports related to LevelBlue assets to this AT&T program
• LevelBlue maintains a separate vulnerability disclosure process for handling security reports
• All LevelBlue-related security concerns should be directed exclusively to their VDP: https://levelblue.com/levelblue-vulnerability-disclosure-program

#Program Terms and Conditions The following Terms and Conditions apply to the Program:

• "AT&T" refers to AT&T Services, Inc., and its affiliates.
• You must comply with the Program and abide by the law.
• AT&T employees, contractors, and their families are not eligible for rewards.
• You must submit your report as soon as you have discovered a potential vulnerability. By submitting the vulnerability, you affirm that you have not disclosed and agree that you will not disclose the vulnerability or your submission to anyone other than AT&T following the process set forth in the Program. Absent AT&T's prior written consent, any disclosure would violate the Program. It is understood and agreed that money damages would not be a sufficient remedy for any breach of this paragraph by you or your representative(s) and that AT&T shall be entitled to specific performance as a remedy for any such breach, including injunctive relief. Such remedy shall not be deemed to be the exclusive remedy for any such breach but shall be in addition to all other remedies available at law or equity to AT&T.
• Submissions selected for rewards, and the individuals who submitted the vulnerabilities will receive recognition at the sole discretion of AT&T.
• By submitting information about a potential vulnerability, you agree to all Program Terms and Conditions and grant AT&T a worldwide, royalty-free, non-exclusive license to use your submission. Only the first submission of a given potential vulnerability that AT&T has not yet identified is eligible. In the event of a duplicate submission, only the earliest received is considered.
• Eligibility for rewards, including the determination of the recipients and reward amount is left up to the sole discretion of AT&T.
• Out of scope vulnerabilities submitted are generally less likely to receive recognition or rewards under the Program.
• You are responsible for all taxes associated with and imposed on any reward you may receive in connection with your submission. HackerOne handles all bounty payments through the HackerOne platform. Please refer to HackerOne’s relevant policies here.
• You may only exploit, investigate, or target vulnerabilities against your own accounts. Testing must not violate any law, or disrupt or compromise any data or access data that is not yours; intentional access of customer data other than your own is expressly prohibited.
• If you inadvertently access customer, employee, or business related information during your testing, you must immediately notify AT&T and the information must not be used, disclosed, stored, or recorded in any way. Inadvertent access of the data must be declared within your submission.
• Your testing activities must not negatively impact AT&T, or AT&T's Environment availability or performance.
• AT&T reserves the right of non-remediation in its sole discretion.
• The Program constitutes the entire agreement and understanding of the parties with respect to the items listed herein. The Program may be amended or modified any time without notice in AT&T’s sole and absolute discretion.
• If any portion of the Program is found to be illegal or unenforceable, then the parties shall be relieved of their responsibilities arising under such portion, but only to the extent that such portion is illegal or unenforceable.

#Reporting Process When reporting vulnerabilities, you must first register or log on to your account on HackerOne. In describing the vulnerability it is important to include all necessary details required for reproducing the vulnerability as well as the tools required to reproduce the vulnerability. Please note that the vulnerability should be treated in accordance with the terms of the Program.

• Reports for Critical and High severity findings must include a video proof of concept (POC) demonstrating the vulnerability; reports without video POC will not be moved forward for triage.
• Each submission will typically receive a reply within one (1) business day acknowledging that the report was successfully received.
• Duplicate submissions (where the vulnerability has already been reported to AT&T are not eligible for rewards. In most instances, you will not be notified of a duplicate report condition until after the vulnerability has been remediated.
• Please recognize that AT&T operates a complex Environment and the amount of time required to address a reported issue can vary from a few hours to several months. You will receive notification of the final outcome of our remediation efforts once the Program is notified by AT&T internal support team. AT&T cannot provide updates on remediation efforts that are in progress.

#Awarding Process

• Only vulnerabilities will be considered for an award. Only those vulnerabilities that have been resolved will receive an award. The bounties range from $50 to $3,000 depending on criteria such as the type/severity of the vulnerability, impacted domain(s), potential vulnerability exploits, and vulnerability report submission quality.
• Retesting previously resolved vulnerabilities to confirm fixes carries a flat $50 fee per retest request.
• In general, Reflected XSS will be considered low severity and awarded with minimum bounty unless other impact is shown. THE CRITERIA USED TO DETERMINE THE PAYOUT FOR A VULNERABILITY IS SOLELY AT THE DISCRETION OF AT&T.

#Change to Program Terms AT&T reserves the right to discontinue the Program at any time without notice in its sole discretion.