Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

HPE VDP

By Hewlett Packard Enterprise Vulnerability disclosure program on HackerOne hpe.com

Accepting reports
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
207
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
No public write-ups
Keep findings private.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Scope

207 assets you may test.

Web 188

  • alpha.infosight.hpe.com Critical No bounty
  • aoe-ext1-itg.it.hpe.com Critical No bounty
  • aoe-ext1-itg-vip.it.hpe.com Critical No bounty
  • aoe-ext-itg.it.hpe.com Critical No bounty
  • aoe-ext-itg.wip.it.hpe.com Critical No bounty
  • api-cip-sgw-dc01.it.hpe.com Critical No bounty
  • api-cip-sgw-dc01-vip.it.hpe.com Critical No bounty
  • api-cip-sgw.ext.hpe.com Critical No bounty
  • api-cip-sgw.it.hpe.com Critical No bounty
  • api-cip-sgw.wip.it.hpe.com Critical No bounty
  • api-csc-itg-sgw.it.hpe.com Critical No bounty
  • api-csc-stg-sgw.ext.hpe.com Critical No bounty
  • api-csc-stg-sgw.it.hpe.com Critical No bounty
  • api-csc-stg-sgw-vip.it.hpe.com Critical No bounty
  • api-ext-dr.it.hpe.com Critical No bounty
  • api-ext-dr.support.hpe.com Critical No bounty
  • api-ext-pro-gtm.wip.it.hpe.com Critical No bounty
  • api-ext-pro-ltm-vip_dr.it.hpe.com Critical No bounty
  • api-ext-pro.support.hpe.com Critical No bounty
  • api-ext-pro.wip.it.hpe.com Critical No bounty
  • api-ext.support.hpe.com Critical No bounty
  • api-gateway.support.hpe.com Critical No bounty
  • api-gw-ext-dr.it.hpe.com Critical No bounty
  • api-gw-ext-dr.support.hpe.com Critical No bounty
  • api-gw-ext-pro.it.hpe.com Critical No bounty
  • api-gw-ext-pro.support.hpe.com Critical No bounty
  • api-gw-ext-pro.wip.it.hpe.com Critical No bounty
  • api-gw-ext.support.hpe.com Critical No bounty
  • api-gw.support.hpe.com Critical No bounty
  • apim-mtls-itg.it.hpe.com Critical No bounty
  • api-mtls-itg.it.hpe.com Critical No bounty
  • api-mtls-itg-vip.it.hpe.com Critical No bounty
  • api-prx-stg-sgw.itcs.hpe.com Critical No bounty
  • api-prx-stg-sgw.it.hpe.com Critical No bounty
  • api-prx-stg-sgw-vip.it.hpe.com Critical No bounty
  • api.support.hpe.com Critical No bounty
  • api-uns-stg-sgw.ext.hpe.com Critical No bounty
  • bmoext-itg.it.hpe.com Critical No bounty
  • bmoext-itg.wip.it.hpe.com Critical No bounty
  • connect2-ltm-myroom-beta1.it.hpe.com Critical No bounty
  • connect2-ltm-myroom-beta1-vip.it.hpe.com Critical No bounty
  • drupalb2b.wip.it.hpe.com Critical No bounty
  • drupalprollb1.it.hpe.com Critical No bounty
  • drupalprollb1-vip.it.hpe.com Critical No bounty
  • ecg-web-dmz-prd-vip.it.hpe.com Critical No bounty
  • elite1.wip.it.hpe.com Critical No bounty
  • entitlement-itg-ui-ext.it.hpe.com Critical No bounty
  • entitlement-prd-srvc-lb-ext.it.hpe.com Critical No bounty
  • entitlement-prd-srvc-lb-ext-vip.it.hpe.com Critical No bounty
  • entitlement-prd-ui-ext.it.hpe.com Critical No bounty
  • entitlement-prd-ui-ext.wip.it.hpe.com Critical No bounty
  • entitlement-prd-ui-lb-ext.it.hpe.com Critical No bounty
  • entitlement-prd-ui-lb-ext-vip.it.hpe.com Critical No bounty
  • entitlement-ui.ext.hpe.com Critical No bounty
  • eop-pro-web.it.hpe.com Critical No bounty
  • eop-pro-web.wip.it.hpe.com Critical No bounty
  • epes-web-itg-edit.it.hpe.com Critical No bounty
  • epes-web-itg-edit-vip.it.hpe.com Critical No bounty
  • epes-web-itg-live.it.hpe.com Critical No bounty
  • epes-web-itg-live-vip.it.hpe.com Critical No bounty
  • epes-web-pro-edit-glb.it.hpe.com Critical No bounty
  • epes-web-pro-edit-glb.wip.it.hpe.com Critical No bounty
  • epes-web-pro-live-glb.it.hpe.com Critical No bounty
  • epes-web-pro-live-glb.wip.it.hpe.com Critical No bounty
  • epes-web-pro-live.it.hpe.com Critical No bounty
  • epes-web-pro-live-vip.it.hpe.com Critical No bounty
  • eponpr1.it.hpe.com Critical No bounty
  • eponpr1-vip.it.hpe.com Critical No bounty
  • eprime1.wip.it.hpe.com Critical No bounty
  • esam-dev.it.hpe.com Critical No bounty
  • ext-pro.support.hpe.com Critical No bounty
  • ext-pro-webserv2-corona.it.hpe.com Critical No bounty
  • ext-pro-webserv2-corona-vip.it.hpe.com Critical No bounty
  • ext-pro-webserv-corona.wip.it.hpe.com Critical No bounty
  • ezc-itglb1-vip.it.hpe.com Critical No bounty
  • ezc-itglb2-vip.it.hpe.com Critical No bounty
  • ezc-itg.wip.it.hpe.com Critical No bounty
  • file-upload-download.itcs.hpe.com Critical No bounty
  • file-upload-download-itg.it.hpe.com Critical No bounty
  • file-upload-download-prd.it.hpe.com Critical No bounty
  • file-upload-download-prd-vip.it.hpe.com Critical No bounty
  • file-upload-download.wip.it.hpe.com Critical No bounty
  • gsd-lead-management.itcs.hpe.com Critical No bounty
  • gsd-lead-management-prd.it.hpe.com Critical No bounty
  • gsd-lead-management-prd-vip.it.hpe.com Critical No bounty
  • gsd-lead-management.wip.it.hpe.com Critical No bounty
  • h18033.www1.hpe.com Critical No bounty
  • h18033.www1.it.hpe.com Critical No bounty
  • h20168.www2.hpe.com Critical No bounty
  • h20427.www2.hpe.com Critical No bounty
  • h20427.www2.it.hpe.com Critical No bounty
  • h20429.www2.hpe.com Critical No bounty
  • h20429.www2.it.hpe.com Critical No bounty
  • h20430.www2.hpe.com Critical No bounty
  • h20430.www2.it.hpe.com Critical No bounty
  • h22168.www2.hpe.com Critical No bounty
  • h22168.www2.it.hpe.com Critical No bounty
  • h22238.www2.hpe.com Critical No bounty
  • h22238.www2.it.hpe.com Critical No bounty
  • h22241.www2.hpe.com Critical No bounty
  • h22241.www2.it.hpe.com Critical No bounty
  • h22242.www2.hpe.com Critical No bounty
  • h22242.www2.it.hpe.com Critical No bounty
  • h22257.www2.hpe.com Critical No bounty
  • h22257.www2.it.hpe.com Critical No bounty
  • h22260.www2.hpe.com Critical No bounty
  • h22260.www2.it.hpe.com Critical No bounty
  • h22261.www2.hpe.com Critical No bounty
  • h22261.www2.it.hpe.com Critical No bounty
  • hpe-operations-prd-web-ctg-vip.it.hpe.com Critical No bounty
  • hpe-operations-prd-web-vip.it.hpe.com Critical No bounty
  • hub-dr-apache-ext.it.hpe.com Critical No bounty
  • infosight.hpe.com Critical No bounty
  • infosight-prod-vip.it.hpe.com Critical No bounty
  • infosight.wip.it.hpe.com Critical No bounty
  • installed-environments-srvc-itg-ext.it.hpe.com Critical No bounty
  • installed-environments-srvc-prd-ext.it.hpe.com Critical No bounty
  • installed-environments-srvc-prd-lb-ext.it.hpe.com Critical No bounty
  • installed-environments-ui-itg-ext.it.hpe.com Critical No bounty
  • installed-environments-ui-prd-ext.it.hpe.com Critical No bounty
  • istio-ecp-iam-prod.it.hpe.com Critical No bounty
  • merchantadmin.buy.hpe.com Critical No bounty
  • myroom-itm.it.hpe.com Critical No bounty
  • myroom-itm-vip.it.hpe.com Critical No bounty
  • ngc-itg-oca-externall.it.hpe.com Critical No bounty
  • ngq-itg1-ext.it.hpe.com Critical No bounty
  • ngq-itg2-ext.it.hpe.com Critical No bounty
  • ngq-itg4-ext.it.hpe.com Critical No bounty
  • ngq-pro-ext2.it.hpe.com Critical No bounty
  • ngq-pro-ext2-vip.it.hpe.com Critical No bounty
  • ngq-pro-ext.it.hpe.com Critical No bounty
  • ngq-pro-ext.wip.it.hpe.com Critical No bounty
  • occ-ext1-vip.it.hpe.com Critical No bounty
  • occ-ext.it.hpe.com Critical No bounty
  • occ-ext.wip.it.hpe.com Critical No bounty
  • ocldevglobalext1.it.hpe.com Critical No bounty
  • ocldevglobalext1-vip.it.hpe.com Critical No bounty
  • ocldevglobalext2.it.hpe.com Critical No bounty
  • ocldevglobalext2-vip.it.hpe.com Critical No bounty
  • ocldevglobalext4.it.hpe.com Critical No bounty
  • ocldevglobalext4-vip.it.hpe.com Critical No bounty
  • ocldevglobalext.it.hpe.com Critical No bounty
  • ocldevglobalext.wip.it.hpe.com Critical No bounty
  • oclglobalextone.it.hpe.com Critical No bounty
  • oclglobalextone.wip.it.hpe.com Critical No bounty
  • oclitgaglobalextone5.it.hpe.com Critical No bounty
  • oclitgaglobalextone5-vip.it.hpe.com Critical No bounty
  • ocllocalextone1.it.hpe.com Critical No bounty
  • ocllocalextone1-vip.it.hpe.com Critical No bounty
  • onepass-enduserservice.it.hpe.com Critical No bounty
  • onepass-enduserservice.wip.it.hpe.com Critical No bounty
  • onepass-restservice.it.hpe.com Critical No bounty
  • onepass-soapservice.it.hpe.com Critical No bounty
  • partner.buy.hpe.com Critical No bounty
  • partnerbuy-vip.it.hpe.com Critical No bounty
  • partnerbuy.wip.it.hpe.com Critical No bounty
  • portal-iam-ext-pro.it.hpe.com Critical No bounty
  • portal-iam-ext-pro.wip.it.hpe.com Critical No bounty
  • prodscpq.vip.it.hpe.com Critical No bounty
  • s360-dev.it.hpe.com Critical No bounty
  • s360.hpe.com Critical No bounty
  • s360-itg2.it.hpe.com Critical No bounty
  • s360-prod-ext.it.hpe.com Critical No bounty
  • s360-prod-ext-ltm.it.hpe.com Critical No bounty
  • s360-prod-ext-ltm-vip.it.hpe.com Critical No bounty
  • s360-prod-ext.wip.it.hpe.com Critical No bounty
  • sce-public1.it.hpe.com Critical No bounty
  • sce-public1-vip.it.hpe.com Critical No bounty
  • sce-public.wip.it.hpe.com Critical No bounty
  • snr-srv-ext-itg.it.hpe.com Critical No bounty
  • snr-srv.ext.it.hpe.com Critical No bounty
  • snr-srv-lb-prd-ext-vip.it.hpe.com Critical No bounty
  • snr-srv-prd.it.hpe.com Critical No bounty
  • snr-srv.wip.it.hpe.com Critical No bounty
  • ssc.hpe.com Critical No bounty
  • supplierportale.it.hpe.com Critical No bounty
  • supplierportale.wip.it.hpe.com Critical No bounty
  • swg-prd.it.hpe.com Critical No bounty
  • swg-prd-vip.it.hpe.com Critical No bounty
  • vwebcsneitg-dmz-itg.it.hpe.com Critical No bounty
  • ws-support-itg.wip.it.hpe.com Critical No bounty
  • wstax-itg.it.hpe.com Critical No bounty
  • wstax-prd.it.hpe.com Critical No bounty
  • wstax-prd-vip.it.hpe.com Critical No bounty
  • wstax.wip.it.hpe.com Critical No bounty
  • wwclass-ext.it.hpe.com Critical No bounty
  • z2z-hpecom-static-prd-poc-01.it.hpe.com Critical No bounty
  • z2z-hpecom-static-prd-poc-01.wip.it.hpe.com Critical No bounty

Wildcard domains 15

  • *.arubanetworks.com* Critical No bounty
  • *axissecurity.com* Critical No bounty
  • *.central.arubanetworks.com* Critical No bounty
  • *cpqcorp.* Critical No bounty
  • *hpe.com High No bounty
  • *hpecore.* Critical No bounty
  • *hpecorp.net Critical No bounty
  • *hpqcorp.* Critical No bounty
  • *.juniper.net Critical No bounty
  • *nimblestorage.* Critical No bounty
  • *pachyderm.com* Critical No bounty
  • *plexxi.* Critical No bounty
  • *silver-peak.com* Critical No bounty
  • *simplivity.* Critical No bounty
  • *zerto.com* Critical No bounty

Products and areas 4

  • Additional HPE Asset Critical No bounty
  • Aruba Critical No bounty
  • *Cray.com* Critical No bounty
  • Vulnerabilities in any HPE products Critical No bounty

Rules

What the policy asks of you, and the bug types it won't reward, quoted from HPE VDP (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Abide by the program scope and only test against systems you have permissions to test.
  • When making an account for testing purposes, please use your HackerOne email alias so we can properly identify you.
  • No social engineering against HPE employees or customers.
  • No denial-of-service attacks against HPE assets or systems or other activity which may affect the integrity or availability of the target systems.
  • If you notice performance degradation on the target systems, you must immediately suspend the activity.
  • Never use a finding to compromise/exfiltrate data or pivot to other systems. Use proof of concept to demonstrate the issue.
  • Do not attempt to compromise any customer accounts or data, or personal information in the possession of HPE.
  • If you inadvertently view or change any personal identifiable information (PII) during your research, stop testing immediately and submit a report to HPE
  • Submit one vulnerability per report unless you need to chain vulnerabilities to demonstrate impact.
  • Researchers must not publicly disclose vulnerabilities or share vulnerabilities with a third party without HPE’s express written permission.

Not accepted

  • Clickjacking on pages with no sensitive actions
  • Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
  • Attacks requiring MITM or physical access to a user's device.
  • Previously known vulnerable libraries without a working Proof of Concept.
  • Comma Separated Values (CSV) injection without demonstrating a vulnerability.
  • Missing best practices in SSL/TLS configuration.
  • Any activity that could lead to the disruption of our service (DoS).
  • Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
  • Rate limiting or bruteforce issues on non-authentication endpoints
  • Missing best practices in Content Security Policy.
  • Missing HttpOnly or Secure flags on cookies
  • Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
  • Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
  • Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
  • Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case-by-case basis.
  • Tab nabbing
  • Open redirect - unless an additional security impact can be demonstrated
  • Issues that require unlikely user interaction

Summarised with AI from the program policy on HackerOne, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 6 minutes ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    *.arubanetworks.com*

  2. Scope added

    *.central.arubanetworks.com*

  3. Scope added

    *.juniper.net

  4. Scope added

    *cpqcorp.*

  5. Scope added

    *Cray.com*

  6. Scope added

    *hpecore.*

  7. Scope added

    *hpecorp.net

  8. Scope added

    *hpqcorp.*

  9. Scope added

    *nimblestorage.*

  10. Scope added

    *plexxi.*

  11. Scope added

    *simplivity.*

  12. Scope added

    Additional HPE Asset

  13. Scope added

    alpha.infosight.hpe.com

  14. Scope added

    aoe-ext-itg.it.hpe.com

  15. Scope added

    aoe-ext-itg.wip.it.hpe.com

  16. Scope added

    aoe-ext1-itg-vip.it.hpe.com

  17. Scope added

    aoe-ext1-itg.it.hpe.com

  18. Scope added

    api-cip-sgw-dc01-vip.it.hpe.com

  19. Scope added

    api-cip-sgw-dc01.it.hpe.com

  20. Scope added

    api-cip-sgw.ext.hpe.com

  21. Scope added

    api-cip-sgw.it.hpe.com

  22. Scope added

    api-cip-sgw.wip.it.hpe.com

  23. Scope added

    api-csc-itg-sgw.it.hpe.com

  24. Scope added

    api-csc-stg-sgw-vip.it.hpe.com

  25. Scope added

    api-csc-stg-sgw.ext.hpe.com

  26. Scope added

    api-csc-stg-sgw.it.hpe.com

  27. Scope added

    api-ext-dr.it.hpe.com

  28. Scope added

    api-ext-dr.support.hpe.com

  29. Scope added

    api-ext-pro-gtm.wip.it.hpe.com

  30. Scope added

    api-ext-pro-ltm-vip_dr.it.hpe.com

  31. Scope added

    api-ext-pro.support.hpe.com

  32. Scope added

    api-ext-pro.wip.it.hpe.com

  33. Scope added

    api-ext.support.hpe.com

  34. Scope added

    api-gateway.support.hpe.com

  35. Scope added

    api-gw-ext-dr.it.hpe.com

  36. Scope added

    api-gw-ext-dr.support.hpe.com

  37. Scope added

    api-gw-ext-pro.it.hpe.com

  38. Scope added

    api-gw-ext-pro.support.hpe.com

  39. Scope added

    api-gw-ext-pro.wip.it.hpe.com

  40. Scope added

    *hpe.com

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Vulnerability Disclosure Rules of Engagement

Welcome to HPE! Hewlett Packard Enterprise (NYSE: HPE) is the global edge-to-cloud company that helps organizations accelerate outcomes by unlocking value from all of their data, everywhere.

With this program, we look forward to working closely with cybersecurity researchers to stress-test our products, discover vulnerabilities, and responsibly disclose them for the maximum benefit of our customers and the ecosystem at large. We believe in the wisdom of the crowd, and in this case, a highly technical crowd. If you have information related to security vulnerabilities in HPE products, we appreciate that you submit a report in accordance with the rules of engagement below.

We value the positive impact of your hard work and thank you in advance for your contribution.

Testing

  1. Abide by the program scope and only test against systems you have permissions to test.
  2. When making an account for testing purposes, please use your HackerOne email alias so we can properly identify you.
  3. No social engineering against HPE employees or customers.
  4. No denial-of-service attacks against HPE assets or systems or other activity which may affect the integrity or availability of the target systems. If you notice performance degradation on the target systems, you must immediately suspend the activity.
  5. For best practice, indicate your identity as a security researcher with custom HTTP headers when sending requests, such as * “X-HackerOne-Research: [H1 username]”.

Disclosure

  1. If you think that you have discovered a security vulnerability, we appreciate your help in disclosing the issue to us. Please do this responsibly by giving us the opportunity to investigate and fix the vulnerability in a timely fashion before publicly disclosing it. Security vulnerability reports will be treated as a high priority.
  2. Researchers must not publicly disclose vulnerabilities or share vulnerabilities with a third party without HPE’s express written permission.
  3. Follow HackerOne's [disclosure guidelines] (https://www.hackerone.com/disclosure-guidelines)

Data Privacy

  1. Never use a finding to compromise/exfiltrate data or pivot to other systems. Use proof of concept to demonstrate the issue.
  2. Do not attempt to compromise any customer accounts or data, or personal information in the possession of HPE. Never attempt to view, modify, or damage data belonging to others.
  3. If you inadvertently view or change any personal identifiable information (PII) during your research, stop testing immediately and submit a report to HPE with reproducible steps so that our team can evaluate the potential business impact of any exposed PII.

Reporting

  1. A good report should include the following information: a. Description of the vulnerability b. Proposed CVSSv3 Vector & Score c. Steps to reproduce the reported vulnerability d. Proof of exploitability (e.g., screenshot, video) e. Proof-of-concept code f. Perceived impact to another user or the organization g. Recommendations for remediation or mitigation h. List of URLs and affected parameters i. Other vulnerable URLS, additional payloads, proof-of-concept code j. Browser, OS, and/or app version used during testing
  2. Submit one vulnerability per report unless you need to chain vulnerabilities to demonstrate impact.
  3. Multiple vulnerabilities caused by one underlying issue will be considered duplicates.

Eligibility

  1. You must not be subject to sanctions administered or enforced by the Office of Foreign Assets Control (OFAC) or other Agency of the United States or be located in a country subject to such sanctions. Your activities much comply with all applicable domestic and international laws, statutes, ordinances, and regulations and you may not participate in this program if this activity is prohibited in your jurisdiction.
  2. Be at least 18 years old and have legal capacity to agree to these terms and participate in the program.
  3. Have permission from your employer to participate.
  4. Not be (for the previous 12 months) an HPE employee, immediate family member of an HPE employee, HPE contractor, or HPE service provider.

Out of Scope vulnerabilities

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

  • Clickjacking on pages with no sensitive actions
  • Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
  • Attacks requiring MITM or physical access to a user's device.
  • Previously known vulnerable libraries without a working Proof of Concept.
  • Comma Separated Values (CSV) injection without demonstrating a vulnerability.
  • Missing best practices in SSL/TLS configuration.
  • Any activity that could lead to the disruption of our service (DoS).
  • Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
  • Rate limiting or bruteforce issues on non-authentication endpoints
  • Missing best practices in Content Security Policy.
  • Missing HttpOnly or Secure flags on cookies
  • Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
  • Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
  • Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors).
  • Public Zero-day vulnerabilities that have had an official patch for less than 1 month will be awarded on a case-by-case basis.
  • Tab nabbing
  • Open redirect - unless an additional security impact can be demonstrated
  • Issues that require unlikely user interaction

Scope Update: Effective 11/3/2025:

*Assets previously covered by the Aruba-Public program at https://bugcrowd.com/engagements/aruba-public are now in scope for HackerOne program. HPE Networking still maintains a separate program that pays bounties for product focused submissions. For scope details please visit https://bugcrowd.com/engagements/hpe-networking-product-public.