Security researcher Faav finds Microsoft Titan flaw enabling admin impersonation
A 16-year-old security researcher named Faav found a big security gap in Microsoft's Titan analytics service, one that could have let attackers pose as the service's administrator and run SQL queries across an estimated 17.3 trillion rows of data across 17 connected databases.
Using an automated tool, Faav uncovered the issue but made sure not to mess with any customer information or use the two Bing samples to identify anyone, link records between datasets, or build user profiles.
Microsoft patches Titan, pays $5,000 bounty
After Faav reported the bug on September 5 (2026), Microsoft locked down the endpoint four days later (September 9, 2026).
Faav received the $5,000 bounty on September 17, 2026.
The company says responsible hackers like Faav help keep everyone safer and says it values and appreciates safe security research under the terms of the Microsoft Bug Bounty Program.