Hello and welcome, researchers! A huge welcome to both our returning researchers joining us here and the new members of the community — your work plays a critical role in helping keep Adobe's products and customers secure, and we're grateful to have you on board. Thank you for being part of this next chapter with us.
To be eligible for a reward, a report must:
- Concern an asset that is in scope
- Concern a vulnerability type that is eligible under this policy
- Be previously unknown to Adobe
- Be valid and reproducible
- Be the first such report received
- Include enough detail for Adobe to reproduce and validate the issue
- Include the researcher’s testing IP address
Reward Calculation Rules
- One issue receives one bounty.
- Multiple submissions caused by a single root cause (one flaw reachable via multiple parameters, endpoints, or locations, resolved by the same fix) are treated as one finding and awarded a single bounty.
- Where submissions reveal a general class/pattern of weakness across distinct locations or components within the same product or shared codebase (each potentially requiring its own fix), the first two valid reports (by submission time, across all researchers) are each eligible for a full bounty at their individually assessed severity; subsequent reports of the same pattern are acknowledged (e.g., Hall of Fame points) but not separately rewarded.
Example — pattern across distinct locations (same product, separate fixes):
Reports A, B, and C each hit a different service in the same product, all caused by the same underlying weakness type but each requiring its own fix.
A and B — the first two to establish the pattern → each eligible for a full bounty, at its own assessed severity.
C (and any further reports of the same pattern) → acknowledged (e.g., Hall of Fame points) but not separately rewarded, as the two-report cap has been reached. - Scope is determined by the affected asset and demonstrated impact, not by which Adobe team remediates the issue. An exception applies to products that integrate IMS: when both the vulnerability and the required remediation reside within IMS, the issue will be classified and rewarded as an IMS issue.
- ATO payouts rules:
| ATO type | Impact | Payout |
|---|---|---|
| Cross-Tenant / Cross-Organization ATO | Compromise achieved by bypassing a tenant/organization isolation or authorization boundary (e.g., cross-org IDOR, tenant-isolation break, auth bypass) or a single exploit that yields multiple victim accounts without per-victim interaction. | Full bounty based on the assessed severity (ATO impact included) |
| Same-Tenant / Single-Account ATO | Compromise limited to a single victim account per exploitation — including 1-click attacks and IMS/session token theft granting access to multiple Adobe products for that one user — regardless of which organization the victim belongs to. No tenant-isolation boundary is bypassed. | The first confirmed, unique ATO technique receives a discretionary bonus on top of the bounty awarded for the underlying vulnerability's severity (scored without the ATO impact). Subsequent reports using the same or substantially similar technique will be assessed and paid based solely on the underlying vulnerability's severity, without the ATO discretionary bonus. |
Note: How the exploit is delivered does not change the ATO category. 1-click or an unauthenticated attacker only affect the underlying vulnerability's severity (via PR/UI) not the ATO tier. The ATO tier is set by how much one successful exploitation compromises: One victim account -> Single account; A whole organization -> Org-wide/cross-org; Other tenants' accounts via an isolation/authorization bypass → Cross-Tenant
- If either the underlying vulnerability or resulting impact has already been reported and validated, subsequent reports demonstrating the same vulnerability or materially similar impact chain will be considered duplicates for that component.
For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.
It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.