Microsoft Paid Out $2.3 Million at Zero Day Quest 2026 Hacking Contest
Researchers found more than 80 high-impact cloud and AI vulnerabilities during the event, which had a $5 million prize pool.
Aggregated from SecurityWeek
This article was automatically aggregated from an external source. Content may be summarized.
Full Analysis
Microsoft has announced the results of its Zero Day Quest 2026 live hacking contest.
The tech giant offered a $5 million prize pool, with $2.3 million awarded to participants across 700 submissions. White hat hackers from over 20 countries took part in the event.
The company said Zero Day Quest 2026 has helped it learn about 80 high-impact vulnerabilities affecting cloud and AI services.
“Many of the findings showed how weaknesses in identity controls or tenant isolation could allow issues identified within authorized test environments to impact other tenants if combined with execution or network-level vulnerabilities,” Microsoft explained.
It noted that researchers “identified critical paths involving credential exposure, SSRF chains, and cross‑tenant access”.
“These findings reinforce the need for layered defenses and strong isolation boundaries across Microsoft’s cloud and AI services, and underscore the importance of addressing upstream control gaps earlier in the development lifecycle in alignment with Secure Future Initiative priorities,” the company said.
Advertisement. Scroll to continue reading.
At Zero Day Quest 2025, Microsoft paid out $1.6 million to participants.
In August 2025, Microsoft announced that it had paid out $17 million in bug bounties in the past year, bringing the total payouts since 2018 to more than $92 million.
Related: Infotainment, EV Charger Exploits Earn Hackers $1M at Pwn2Own Automotive 2026
Related: Pwn2Own WhatsApp Hacker Says Exploit Privately Disclosed to Meta
Related: $320,000 Paid Out at Zeroday.Cloud for Open Source Software Exploits
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
With "Shadow AI" usage becoming prevalent in organizations, learn how to balance the need for rapid experimentation with the rigorous controls required for enterprise-grade deployment.
Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization.
Originally published by SecurityWeek
Original Source
SecurityWeek