Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Cloud Software Group

By Citrix Bug bounty on HackerOne citrix.com

Accepting reports
Go to program Website
Top reward
$5,000
Top severity paid
Critical
Assets in scope
17
Public CVEs
60
Last change
No changes yet

At a glance

What to know before you start testing.

Pays up to $5,000
for critical bugs.
Report on HackerOne
Submit through the program page.
Replies within 1 day
As the policy promises.
No public write-ups
Keep findings private.

Rewards

What HackerOne lists as the payout for each severity.

Severity Reward
Critical $5,000
High $2,000
Medium $250
Response
Within 1 days Time to first response (from report submit) - 1 business days

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

17 assets you may test, 16 excluded.

Web 9

  • accounts.cloud.com Critical
  • adm.cloud.com Critical
  • api.adm.cloud.com Critical
  • ap-s.cloud.com Critical
  • *developer.cloud.com Informational No bounty
  • eu.cloud.com Critical
  • onboarding-*.cloud.com Critical
  • onboarding.cloud.com Critical
  • us.cloud.com Critical

Android apps 1

  • Citrix Secure Access client for Android Critical

iOS apps 1

  • Citrix Secure Access client for macOS Critical

Wildcard domains 1

  • *.citrixworkspacesapi.net Critical

Products and areas 5

  • Citrix End Point Analysis (EPA) client for Linux Critical
  • Citrix End Point Analysis (EPA) client for Windows Critical
  • Citrix Secure Access client for iOS Critical
  • Citrix Secure Access client for Linux Critical
  • Citrix Secure Access client for Windows Critical
Out of scope (16)
  • accounts-internal.cloud.com
  • citrix.cloud.com
  • launch.cloud.com
  • www.cloud.com
  • (youriwssubdomain).cloud.com
  • (yoursubdomain).ap.iws.cloud.com
  • (yoursubdomain).eu.iws.cloud.com
  • (yoursubdomain).us.iws.cloud.com
  • *.browser.cloud.com
  • *.citrix*.com
  • *.cloudburrito.com
  • *.podio.com
  • *.securevdr.com
  • *.xmdev.cloud.com
  • *.xmqa.cloud.com
  • *.xmtest.cloud.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Cloud Software Group (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Please provide detailed reports with reproducible steps.
  • Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
  • Social engineering techniques (e.g., phishing, vishing, smishing) are prohibited.
  • Only interact with accounts you own or with explicit permission of the account holder.
  • Use “H1_” as a prefix in the “customer ID” field when registering for an account.
  • When registering for your test account, please use HackerOne's new email aliases

Not accepted

  • Clickjacking and issues only exploitable through clickjacking
  • Descriptive error messages (e.g., Stack Traces, application, or server errors) without proof of vulnerability or risk
  • HTTP 404 codes/pages or other HTTP non-200 codes/pages
  • Fingerprinting/banner disclosure on common/public services
  • Disclosure of known public files or directories, e.g., robots.txt
  • Scripting or other automation and brute forcing of intended functionality
  • Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality
  • Lack of Secure and HTTPOnly cookie flags
  • Content spoofing (text injection) or IDN homograph attacks or reflected file download attacks
  • Tabnabbing
  • Email configuration issues (SPF, DKIM, DMARC)
  • Weak captcha or captcha bypass
  • Forced login/logout CSRF
  • Account lockout, login, or forgot password page brute force
  • Password complexity or account recovery policies
  • HTTPS Mixed Content
  • Missing HTTP security headers
  • Known SSL issues
  • SSL Forward Secrecy or HSTS not enabled
  • Weak SSL/TLS cipher suites
  • Use of a known-vulnerable library without evidence of exploitability
  • Problems related to widely publicized CVE's
  • Attacks requiring physical access to a user's unlocked device
  • Username/email enumeration
  • Any activity that could lead to the disruption of our service (DoS)

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 17 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD
CVESeverityPublished
CVE-2026-88779 High 8.7 4 Oct 2026
CVE-2026-88778 High 8.8 27 Sep 2026
CVE-2026-88773 Critical 9.3 27 Sep 2026
CVE-2026-88776 High 8.8 27 Sep 2026
CVE-2026-88775 High 8.8 27 Sep 2026
CVE-2026-88774 High 7.0 27 Sep 2026
CVE-2026-88777 High 8.8 27 Sep 2026
CVE-2026-88772 Critical 9.5 27 Sep 2026
CVE-2026-88771 Critical 9.5 27 Sep 2026
CVE-2026-19490 Critical 9.3 19 Aug 2026
CVE-2026-8655 High 8.8 30 Jun 2026
CVE-2026-8451 High 8.8 30 Jun 2026
CVE-2026-8452 High 8.8 30 Jun 2026
CVE-2026-13474 High 8.7 30 Jun 2026
CVE-2026-10816 High 7.1 30 Jun 2026
CVE-2026-10817 Medium 6.9 30 Jun 2026
CVE-2026-3055 Critical 9.3 23 Mar 2026
CVE-2025-7776 High 8.8 26 Aug 2025
CVE-2025-7775 Critical 9.2 26 Aug 2025
CVE-2025-6759 High 7.3 8 Jul 2025
CVE-2025-6543 Critical 9.2 25 Jun 2025
CVE-2025-4879 High 7.3 17 Jun 2025
CVE-2025-0320 High 8.6 17 Jun 2025
CVE-2025-5777 Critical 9.3 17 Jun 2025
CVE-2025-5349 High 8.7 17 Jun 2025
CVE-2025-4365 Medium 6.9 17 Jun 2025
CVE-2025-1223 Medium 5.9 20 Feb 2025
CVE-2025-1222 Medium 5.9 20 Feb 2025
CVE-2024-12284 High 8.8 20 Feb 2025
CVE-2024-8534 High 8.4 12 Nov 2024
CVE-2024-8535 Medium 5.8 12 Nov 2024
CVE-2024-8069 Medium 5.1 12 Nov 2024
CVE-2024-8068 Medium 5.1 12 Nov 2024
CVE-2024-7890 Medium 5.4 11 Sep 2024
CVE-2024-7889 High 7.0 11 Sep 2024
CVE-2024-42423 Medium 6.1 10 Sep 2024
CVE-2024-6677 High 7.3 12 Jul 2024
CVE-2024-6286 High 8.5 10 Jul 2024
CVE-2024-6236 High 7.1 10 Jul 2024
CVE-2024-6151 High 8.5 10 Jul 2024
CVE-2024-6150 Medium 4.8 10 Jul 2024
CVE-2024-6149 Medium 4.8 10 Jul 2024
CVE-2024-6148 Medium 5.3 10 Jul 2024
CVE-2024-6235 Critical 9.4 10 Jul 2024
CVE-2024-5491 High 7.2 10 Jul 2024
CVE-2024-5492 Medium 5.1 10 Jul 2024
CVE-2024-0093 Medium 6.5 13 Jun 2024
CVE-2024-0092 Medium 5.5 13 Jun 2024
CVE-2024-0091 High 7.8 13 Jun 2024
CVE-2024-0090 High 7.8 13 Jun 2024
CVE-2024-0086 Medium 5.5 13 Jun 2024
CVE-2024-0085 Medium 6.3 13 Jun 2024
CVE-2024-0084 High 7.8 13 Jun 2024
CVE-2024-5661 Medium 6.0 13 Jun 2024
CVE-2024-3661 High 7.6 6 May 2024
CVE-2024-2049 Medium 6.5 12 Mar 2024
CVE-2023-6184 Medium 5.0 18 Jan 2024
CVE-2023-6549 High 8.2 17 Jan 2024
CVE-2023-6548 Medium 5.5 17 Jan 2024
CVE-2023-31026 Medium 6.0 2 Nov 2023

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Citrix Bug Bounty Program Policy

Citrix looks forward to working with the security community to find security vulnerabilities to keep our businesses and customers safe.

Your participation in the Bug Bounty Program (“Program”) is voluntary and subject to the terms and conditions set forth in this Citrix Bug Bounty Program Policy (the “Policy”), and any other agreement in which you have entered with Citrix in connection with the Program (collectively “Citrix Agreements”). By submitting a vulnerability to Citrix, you acknowledge that you have read and agreed to this Policy and the Citrix Agreements.

Citrix maintains the right to terminate this Bug Bounty Program (“Program”) at any time with or without notice. Citrix may amend this Policy at any time by posting a revised version on our HackerOne policy page. By continuing to participate in the Program after any such changes, you accept the Policy’s terms and conditions, as modified.

Citrix may, in its sole discretion, remove you from the Program, or disqualify you from receiving any benefit of the Program, if you breach this Policy or any of the Program’s terms, or if Citrix determines that your participation in the Program could adversely affect Citrix, our affiliates, subsidiaries, customers, employees or agents.

SLA

Citrix will try to meet the following SLAs for hackers participating in our program:

  • Time to first response (from report submit) - 1 business days
  • Time to triage (from report submit) - 1 business days
  • Time to initial bounty (from triage) - 5 business days

We will award a portion of the bounty upon triage of a valid report. The full bounty amount will be awarded upon remediation of the issue after its impact is fully assessed.

We will try to keep you informed about our progress throughout the process.

Creating your Citrix Accounts

##Update - Citrix Cloud trial and test account creation is now officially out of scope for this program. We are currently in the process of removing the "Citrix_Cloud_Setup_Guide.pdf" to prevent further confusion.

  • When registering for your test account, please use HackerOne's new email aliases - instructions here.
  • Use “H1_” as a prefix in the “customer ID” field when registering for an account.
  • This is very important to ensure our sales team does not treat your test account as a lead.
  • When your trial expires, you can generate a second test account by appending "+1" to your HackerOne email alias.

For help getting your test account setup, see {F1032793}

If you have any questions regarding the scope or setup, please direct them to [email protected]

Disclosure Policy

  • Although this is a public program, you are not permitted to discuss or publish anything about any vulnerabilities (even resolved ones) without express written consent from Citrix.
  • In the event of any inconsistency between this Policy and HackerOne’s disclosure guidelines, this Policy will govern and control.
  • If you prefer not to be part of the Citrix Bug Bounty Program, you may submit issues via Citrix's coordinated disclosure program. However, please note that reports submitted via our coordinated disclosure program do not qualify for a bounty.

Program Rules

  • Follow HackerOne's code of conduct.
  • Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
  • If you find a vulnerability which is out of scope for this Program, please report it, but note it may not be eligible for a bounty.
  • Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
  • When duplicates occur, we only award the first report that was received (provided that the steps in the report can be fully reproduced).
  • Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
  • Social engineering techniques (e.g., phishing, vishing, smishing) are prohibited.
  • Leaking of credentials may not be eligible for bounty. They will be evaluated on a case-by-case basis depending on impact.
  • You are prohibited from engaging in any privacy violations, trading stolen user credentials, destroying data, or interrupting or degrading our service (including without limitation, spam, DoS attacks or DDoS attacks).
  • Only interact with accounts you own or with explicit permission of the account holder.
  • You are prohibited from engaging in any activity that results in you, or any third party, accessing, acquiring, altering, copying, storing, saving, sharing, transferring, deleting, destroying, or otherwise processing user data. Contact us immediately if you do inadvertently encounter userdata, and immediately and securely purge any local information upon reporting the vulnerability to Citrix.
  • To be eligible for the Bug Bounty Program, you must not:
  • Be a resident of, or make your submission from, a country against which the United States has issued export sanctions or other trade restrictions (e.g., Cuba, Iran, North Korea, Sudan, and Syria).
  • Be in violation of any national, state, or local law or regulation.
  • Be a current employee of Citrix or its affiliates or subsidiaries, or an employee who has left Citrix, or its affiliates or subsidiaries within the past 12 months.
  • Be an immediate family member of a person employed by Citrix or its subsidiaries or affiliates; or
  • Be less than 13 years of age. If you are between the ages of 13 - 17 years old but are considered a minor in your place of residence, you must get your parent’s or legal guardian’s permission prior to participating in the program.
  • Cloud Software Group would like to focus this engagement on our products and services. As a result, reports containing issues related to the Enterprise itself (such as compromised credentials) are considered out of scope for the program and will be awarded 50% of the nominal bounty. While these reports are useful, they are secondary considerations against the protection of the Cloud Software Group products and services suite.

Out of scope vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

  • Subdomain takeovers on Cloud Software Group domains
  • Vulnerabilities found on subdomains of cloud.com which are not explicitly listed in scope
  • Reports of stolen or compromised corporate data or employee credentials
  • Clickjacking and issues only exploitable through clickjacking
  • Descriptive error messages (e.g., Stack Traces, application, or server errors) without proof of vulnerability or risk
  • HTTP 404 codes/pages or other HTTP non-200 codes/pages
  • Fingerprinting/banner disclosure on common/public services
  • Disclosure of known public files or directories, e.g., robots.txt
  • Scripting or other automation and brute forcing of intended functionality
  • Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality
  • Lack of Secure and HTTPOnly cookie flags
  • Content spoofing (text injection) or IDN homograph attacks or reflected file download attacks
  • Tabnabbing
  • Email configuration issues (SPF, DKIM, DMARC)
  • Weak captcha or captcha bypass
  • Forced login/logout CSRF
  • Account lockout, login, or forgot password page brute force
  • Password complexity or account recovery policies
  • HTTPS Mixed Content
  • Missing HTTP security headers
  • Known SSL issues
  • SSL Forward Secrecy or HSTS not enabled
  • Weak SSL/TLS cipher suites
  • Issues related to networking protocols or industry standards not controlled by Citrix
  • Sending vulnerability reports using automated tools without validation
  • Use of a known-vulnerable library without evidence of exploitability
  • Problems related to widely publicized CVE's
  • Attacks requiring physical access to a user's unlocked device
  • Reports of spam, phishing, or security best practices
  • Username/email enumeration
  • Bugs in content/services that are not owned/operated by Citrix
  • Vulnerabilities affecting users of outdated or unsupported browsers or platforms
  • Any activity that could lead to the disruption of our service (DoS)
  • Comma Separated Values (CSV) injection without demonstrating a vulnerability
  • Content spoofing and HTML injection issues without showing an attack vector/without being able to execute JavaScript
  • HTTP OPTIONS/TRACE/PUT methods enabled
  • Disclosure of private IP addresses in HTTP responses
  • 3rd party feature abuse (data: URL schema)
  • Partner sites/services

Scope Overview

The circled services are in scope for testing: {F1032797}

Thank you for helping keep Citrix and our users safe!