- Top reward
- $4,000
- Top severity paid
- Critical
- Assets in scope
- 63
- Public CVEs
- 13
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $4,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 2 days
- As the policy promises.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$4,000 from $2,001 |
| High |
|
$2,000 from $1,001 |
| Medium |
|
$1,000 from $501 |
| Low |
|
$500 from $100 |
- Response
-
Within 2 days
Time to first response (from report submit) - 2 business days
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
63 assets you may test, 8 excluded.
Web 54
- ab2b0c50cdc7b445391f99d4957850c5-cd4ccfdb37dfafad.elb.us-east-1.amazonaws.com Critical
- aebddc74953f248bc8455665b0f7d47b-78af959a11e5d0c1.elb.us-east-1.amazonaws.com Critical
- cloud.forescout.com Critical
- community.forescout.com Critical
- datapod-1-100-druid-ingest.development.forescoutcloud.net Critical
- datapod-1-100-druid-ingest.testing.forescoutcloud.net Critical
- datapod-1-100-druid-query.development.forescoutcloud.net Critical
- datapod-1-100-druid-query.production.forescoutcloud.net Critical
- datapod-1-druid-ingest.production.forescoutcloud.net Critical
- datapod-1-ingest.production.forescoutcloud.net Critical
- datapod-1-query.production.forescoutcloud.net Critical
- datapod-2-druid-ingest.production.forescoutcloud.net Critical
- datapod-2-ingest.acceptance.forescoutcloud.net Critical
- datapod-2-query.acceptance.forescoutcloud.net Critical
- de.forescout.cloud Critical
- http://backend-api.devicecloud.production.forescoutcloud.net/api/v1/settings Critical
- http://datapod-1-druid-ingest.production.forescoutcloud.net/v1/upload Critical
- http://datapod-1-druid-query.production.forescoutcloud.net/v1/polling Critical
- http://datapod-1-druid-query.production.forescoutcloud.net/v1/query/agg Critical
- http://datapod-1-druid-query.production.forescoutcloud.net/v2/deletestatus Critical
- http://datapod-1-druid-query.production.forescoutcloud.net/v2/matrixoverview Critical
- http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/firstreporttimeentry Critical
- http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/grouptogroup Critical
- http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/iplist Critical
- http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/ips/bydst/details Critical
- http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/ips/bysrc Critical
- http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/overlappinggroups Critical
- http://datapod-1-druid-query.production.forescoutcloud.net/v2/service-list Critical
- http://datapod-1-druid-query.production.forescoutcloud.net/v2/services Critical
- http://datapod-1-druid-query.production.forescoutcloud.net/v3/matrixoverview Critical
- http://datapod-1-druid-query.production.forescoutcloud.net/v3/query/overlappingzones Critical
- http://datapod-1-druid-query.production.forescoutcloud.net/v3/query/zonetozone Critical
- http://logstash-props.devicecloud.production.forescoutcloud.net/api/v1/properties Critical
- http://mgmtpod-1.production.forescoutcloud.net/oauth/token Critical
- https://telemetry-polling.devicecloud.acceptance.forescoutcloud.net/v1/package Critical
- https://telemetry-polling.devicecloud.acceptance.forescoutcloud.net/v1/polling Critical
- https://telemetry-polling.devicecloud.acceptance.forescoutcloud.net/v1/upload Critical
- iris-testing-us-east-1-nlb-4df4bbde6f6e2bbb.elb.us-east-1.amazonaws.com Critical
- logstash-props.devicecloud.acceptance.forescoutcloud.net Critical
- mgmtpod-1-dashboard.production.forescoutcloud.net Critical
- mgmtpod-1.production.forescoutcloud.net Critical
- mgmt-sensors.iris.acceptance.forescoutcloud.net Critical
- mgmt-sensors.iris.production.forescoutcloud.net Critical
- obs-sensors.iris.acceptance.forescoutcloud.net Critical
- obs-sensors.iris.production.forescoutcloud.net Critical
- streaming-api.iris.acceptance.forescoutcloud.net Critical
- streaming-api.iris.production.forescoutcloud.net Critical
- streaming-gw.iris.production.forescoutcloud.net Critical
- streaming.iris.acceptance.forescoutcloud.net Critical
- streaming.iris.production.forescoutcloud.net Critical
- uk.forescout.cloud Critical
- updates.forescout.com Critical
- us.forescout.cloud Critical
- www.forescout.com Critical
Networks 8
- 194.90.151.192/28 Critical
- 194.90.25.80/29 Critical
- 194.90.89.165/32 Critical
- 212.143.112.81/29 Critical
- 38.140.238.56/29 Critical
- 64.47.18.80/29 Critical
- 64.84.60.0/24 Critical
- 97.105.243.96/28 Critical
Hardware and IoT 1
- CounterAct 9.x High
Out of scope (8)
- datapod-1-100-ingest.development.forescoutcloud.net
- datapod-1-100-ingest.testing.forescoutcloud.net
- datapod-1-100-query.development.forescoutcloud.net
- datapod-1-100-query.testing.forescoutcloud.net
- datapod-1-ingest.acceptance.forescoutcloud.net
- datapod-1-query.acceptance.forescoutcloud.net
- mgmtpod-1-100-dashboard.development.forescoutcloud.net
- mgmtpod-1-100.development.forescoutcloud.net
Rules
What the policy asks of you, and the bug types it won't reward, quoted from ForeScout Technologies (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
-
Submit one vulnerability per the report, unless you need to chain vulnerabilities to provide impact.
-
When duplicates occur, Forescout only awards the first report that was received (provided that it can be fully reproduced).
-
Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
-
You will not engage in social engineering (e.g. phishing, vishing, smishing).
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of Forescout’s services.
-
Only interact with accounts you own or with the explicit permission of the account holder.
Not accepted
-
Clickjacking on pages with no sensitive actions.
-
HTML injection using the search function.
-
Unauthenticated/logout/login CSRF.
-
Attacks requiring MITM or physical access to a user's device.
-
Previously known vulnerable libraries without a working Proof of Concept.
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
-
Missing best practices in SSL/TLS configuration.
-
Any activity that could lead to the disruption of our service (DoS).
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS.
-
Missing best practices in SPF/DKIM/DMARC configurations
-
Wordpress REST API user disclosure
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2025-4660 | A remote code execution vulnerability exists in the Windows agent component of SecureConnector due to improper access controls on a named pipe. The pipe is accessible to the Everyone group and does not restrict remote connections, allowing any network-based attacker to connect without authentication. By interacting with this pipe, an attacker can redirect the agent to communicate with a rogue serv | High 8.7 | 13 May 2025 |
| CVE-2024-9950 | A vulnerability in Forescout SecureConnector v11.3.07.0109 on Windows allows unauthenticated user to modify compliance scripts due to insecure temporary directory. | High 8.5 | 2 Jan 2025 |
| CVE-2024-9949 | Denial of Service in Forescout SecureConnector 11.1.02.1019 on Windows allows Unprivileged user to corrupt the configuration file and cause Denial of Service in the application. | Medium 5.8 | 23 Oct 2024 |
| CVE-2024-22795 | Insecure Permissions vulnerability in Forescout SecureConnector v.11.3.06.0063 allows a local attacker to escalate privileges via the Recheck Compliance Status component. | High 7.0 | 8 Feb 2024 |
| CVE-2023-39374 | ForeScout NAC SecureConnector version 11.2 - CWE-427: Uncontrolled Search Path Element | High 7.8 | 3 Sep 2023 |
| CVE-2021-36724 | ForeScout - SecureConnector Local Service DoS - A low privilaged user which doesn't have permissions to shutdown the secure connector service writes a large amount of characters in the installationPath. This will cause the buffer to overflow and override the stack cookie causing the service to crash. | Medium 6.1 | 29 Dec 2021 |
| CVE-2021-28098 | An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function. SecureConnector runs with administrative privileges and writes logs entries to a file in %PROGRAMDATA%\ForeScout SecureConnector\ that has full permissions for the Everyone group. Using a symbolic link allows an attacker to point the log file to a privileged | High 7.8 | 14 Apr 2021 |
| CVE-2016-9485 | On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable full functionality of the agent. The typical configuration is for the agent to run as a Windows service under the local SYSTEM account. The SecureConnector agent runs various plugin scripts and executables on the endpoint in order to gather and report informat | High 7.8 | 13 Jul 2018 |
| CVE-2016-9486 | On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account in order to enable full functionality of the agent. The typical configuration is for the agent to run as a Windows service under the local SYSTEM account. The SecureConnector agent runs various plugin scripts and executables on the endpoint in order to gather and report informat | High 7.8 | 13 Jul 2018 |
| CVE-2012-4982 | Open redirect vulnerability in assets/login on the Forescout CounterACT NAC device before 7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the a parameter. | Medium 5.8 | 5 Dec 2012 |
| CVE-2012-4983 | Multiple cross-site scripting (XSS) vulnerabilities on the Forescout CounterACT NAC device before 7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the a parameter to assets/login or (2) the query parameter to assets/rangesearch. | Medium 4.3 | 5 Dec 2012 |
| CVE-2012-4985 | The Forescout CounterACT NAC device 6.3.4.1 does not block ARP and ICMP traffic from unrecognized clients, which allows remote attackers to conduct ARP poisoning attacks via crafted packets. | Medium 4.3 | 5 Dec 2012 |
| CVE-2012-1825 | Multiple cross-site scripting (XSS) vulnerabilities in the status program on the ForeScout CounterACT appliance with software 6.3.3.2 through 6.3.4.10 allow remote attackers to inject arbitrary web script or HTML via (1) the loginname parameter in a forgotpass action or (2) the username parameter. | Medium 4.3 | 11 Jun 2012 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Forescout Technologies (the organization) looks forward to working with the security community to find vulnerabilities in order to keep its businesses and customers safe.
#Response Targets
Forescout Technologies will make commercially reasonable efforts to meet the following response targets for hackers participating in its HackerOne program: • Time to first response (from report submit) - 2 business days • Time to triage (from the first response) - 5 business days • Time to bounty (from triage) - 14 business days
Forescout will try to keep you informed about its progress throughout the process.
#Disclosure Policy
• Follow HackerOne's disclosure guidelines. Notwithstanding the HackerOne disclosure guidelines, the contents of a Vulnerability Report may only be made publicly available at Forescout’s sole discretion.
• Notwithstanding anything to the contrary, the Vulnerability Report shall be deemed the confidential information of Forescout and shall not be publicly disclosed without its prior written consent or used outside the scope of this policy. Program Rules
• Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward. When reporting vulnerabilities, please consider (1) attack scenario/exploitability, and (2) the security impact of the bug.
• Submit one vulnerability per the report, unless you need to chain vulnerabilities to provide impact.
• When duplicates occur, Forescout only awards the first report that was received (provided that it can be fully reproduced).
• Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
• You will not engage in social engineering (e.g. phishing, vishing, smishing).
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of Forescout’s services. Only interact with accounts you own or with the explicit permission of the account holder.
#Out of scope vulnerabilities
See below for domains that are in the scope of this policy. You may not take any action to jeopardize the security of any system that holds our customers’ data or disclose their confidential information without their written consent.
The following issues are considered out of scope: • Clickjacking on pages with no sensitive actions. • HTML injection using the search function. • Unauthenticated/logout/login CSRF. • Attacks requiring MITM or physical access to a user's device. • Previously known vulnerable libraries without a working Proof of Concept. • Comma Separated Values (CSV) injection without demonstrating a vulnerability. • Missing best practices in SSL/TLS configuration. • Any activity that could lead to the disruption of our service (DoS). • Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS. • Missing best practices in SPF/DKIM/DMARC configurations • Wordpress REST API user disclosure
#Issues prevalent across multiple language sites
Please note that any vulnerability found on the marketing websites that also exist across other language subdomains will be considered one root issue and all subsequent reports will be marked as a duplicate of the first report submitted to the program.
#Safe Harbor
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
Thank you for helping keep Forescout Technologies and our users safe!