A Telegram price sheet dated 12 September 2026 listed eight tools for $30 to $120 (dollar denomination unstated), and one subscription showed lifetime prices of both $120 and $250. One line offered an “unpatched” 0day mass exploit for a CMS framework at $60. A WordPress hacking tool on the same sheet cost the same (record XT-E031 in the evidence catalogue). On this sheet, the 0-day label did not change the asking price at all.
That raises a sharper question about 0-day exploit offers: does the word ever arrive with a named vulnerability? To find out, we read and classified 700 collected posts. Of the 193 seller posts, 182 are exploit-related, and 93 of those use the word 0-day or zero-day somewhere. None of the 93 names a CVE.
Only 37 of the 93 were assigned our unnamed-exploit claim code. That is a broad bucket, not one flaw each: it also takes in research services, multi-exploit price lists and chained exploits.
The rest are 25 service menus, community adverts and other goods, plus 12 mass-exploitation tools. Another 8 are unlicensed or shared-tool bundles, 5 exploit-feed subscriptions and 3 kits or builders. One each is a course, a scanner and a repackaged proof of concept. For most, 0-day is sales vocabulary.
A 0-day may have no public CVE yet, and sellers may omit identifiers on purpose. So a missing CVE alone does not show whether a claim is real or false. What it shows is that none of the 93 gives a CVE identifier. We use 182 seller posts for the label statistics and all 193 for price and object statistics, because 182 is 193 minus 11 off-topic commercial posts.
- 93Of 182 seller posts use the word 0-day or zero-day (51.1%)Source: Brandefense Blackhole, 1 January to 27 October 2026
- 37Of those 93 were coded as unnamed-exploit claimsSource: Brandefense Blackhole, 1 January to 27 October 2026
- 0Of those 93 name a CVESource: Brandefense Blackhole, 1 January to 27 October 2026
- 2Of 221 offers and requests name a CVE at allSource: Brandefense Blackhole, 1 January to 27 October 2026
Two further checks point the same way. We read all 33 CVE-named posts of the candidate pool that fell outside the sample, and none was an offer or a request. Inside the sample, only 2 of 221 offers and requests name a CVE at all.
What the Offers Actually Contain
The unnamed 0-day claim is the largest single label, with 57 of 221 records (25.8%), but 15 of those are buyers asking for one. On the seller side, 36 posts sell a mass-exploitation tool and 20 sell the web shells such tools produce (56 together).
Coded exploit-claim posts number 47 across three categories. They are 42 unnamed-exploit claims (a broad code; 5 avoid the word itself), 2 CVE-named offers and 3 repackaged public proofs of concept. The two groups are comparable in size, with tools and shells slightly ahead.
The mass-exploitation tools are more concrete. An Indonesian-language bot of 20 January automates scanning and shell upload for WordPress and comes with a trial and a course (XT-E001). What it sells is an automated exploitation pipeline whose output is web shells, not a single vulnerability.
Web software, CMS and plugins form the largest stated target class, with 95 of 221 records (43%), while 71 name no target. Enterprise applications have 21, browsers and phones 16, and operating-system privilege escalation 11. Edge VPN and firewall products are not among the stated targets in this slice, which says more about the collection than about edge risk.
Buyers Define 0-Day Strictly, Sellers Loosely
The NIST glossary defines a zero-day attack as one that exploits a previously unknown hardware, firmware or software vulnerability. One buyer in our records uses that strict meaning outright, while several sellers do not.
On 15 May a forum buyer posted a budget of up to $1 million (denomination unstated) for unpublished remote code execution in products it calls webapps. The same post refused 1-days outright (XT-E020). On 8 March an acquisition call set a ceiling of $3 million for an Android full chain (XT-E008), though neither post shows a payment.
Sellers use the word loosely. A one-line “0-Day Exploit” listing for a business-intelligence tool was followed on 14 August by a paid VIP offer built from public vendor and press write-ups (XT-E029).
A free post of 17 March advertised a “zero-day exploitation framework” with public install steps and the existing CVE-2024-2026 identifier; no relationship between its Passster stored-XSS flaw and the advertised framework was established (XT-E010). On 27 August one seller offered an exploit for a CVE and called it a “1-day”, stating that no public proof of concept existed (XT-E030).
Two dated records show the gap between a seller’s label and a public catalogue. A relay on 6 March reported a $220,000 “0-day” sale for a CVE that CISA had listed in its Known Exploited Vulnerabilities catalogue 24 days earlier (XT-E007). A notebook-server exploit tool of 3 June gave only a CVE suffix, and the matching entry had been listed 41 days before (XT-E023).
These are date relations, not early warning. Of the two offers that named a CVE themselves, only the June one matched a 2026 CISA catalogue entry.
What the Price Tiers Actually Separate
No priced seller post gives a CVE identifier. Within-advertisement tiers provide selected evidence about what the advertised price is attached to. We compared six catalogue records, selected for variety and not for prevalence.
| Record and what its tiers separate | Price as stated ($ = dollar denomination not stated) |
|---|---|
| XT-E002, 25 Jan: one of three copies, or all three | $80,000, or $200,000 |
| XT-E015, 26 Apr: exclusive sale, or shared copy (10 slots) | $15,000, or $900 to $10,000 |
| XT-E004, 16 Feb: devices and installs, plus support and add-ons | $3,000, $5,000, $9,000 |
| XT-E022, 22 May: source code, or monthly bot service | $5,000, or $1,700 a month |
| XT-E034, 25 Sep: “live zero-day” plus access, one buyer | $150 USD |
| XT-E031, 12 Sep: one “unpatched” CMS tool in an eight-tool sheet | $60 |
Two ads price exclusivity directly. The kernel privilege-escalation advertisement asks $200,000 for all three copies against $240,000 at the single-copy price (our arithmetic), and the iOS chain separates an exclusive sale from shared copies. The cross-platform chain tiers by devices but also adds support, private command infrastructure and a rootkit add-on. The authenticator-extraction advertisement separates a source sale from a monthly bot service.
The competing explanation is the claimed capability and target. A kernel escalation, an iOS chain and a CMS tool describe different advertised technical objects, whatever the number of copies. The sample cannot separate the two, because none of these priced seller posts gives a CVE identifier and the two CVE-named offers show no price. Only 70 of 193 seller posts (36.3%) show any stated amount.
Scarcity wording appears across product types, so a buyer limit alone does not establish how rare an underlying vulnerability is. A trust or scarcity term shows up in 71 of 221 records (32.1%), led by slot or stock limits with 21.
A shell-finder tool advertised on 20 September showed a counter of 0 of 5 and, the next day, 2 of 5 (XT-E032, XT-E033). A lifetime bundle at 30 GBP was “limited to 20 users” (XT-E014).
The same pricing mechanism appears in ransomware tooling. Our EDR killer price ladder shows kernel tools priced for single or shared buyers, and a six-slot cap at $8,000 a slot (XT-E012). In the advertisements compared here and in the EDR killer post, sellers meter access by the number of buyers, and we do not recount that product here.
Closed Forums and Brokers Sit Outside This Collection
Closed forums and brokers are a likelier home for a genuine 0-day trade than the channels we collect, and our collection barely reaches them. Forums supply 229 of the 700 sampled posts (33%) and Telegram 438 (63%), yet Telegram supplies 195 of the 221 offers and requests against 25 from forums. Among the forum posts, 161 were spam or off-topic noise, 124 of them adult-content lists. Brokers, vetted forums and Tor sites are largely outside Blackhole collection.
Hints of an intermediary layer are visible in the collected records. One post names a flat $5,000 fee for introducing each 0-day, separate from the exploit price, without saying who charges or pays it (XT-E006). Another routes settlement through a middleman on a named crime forum (XT-E002). Our conclusion is therefore narrow: in the collected slice, “0-day” is mostly a label, and we cannot describe how elite 0-day pricing works.
The counts are also lower bounds. A check of 120 posts without sale words found 6 on-topic records, which implies the filter caught about 69% of on-topic records (range 51% to 83%). For the wider market of goods sold, see our overview of what cybercriminals are selling.
Which Part of the Patch Queue Does a 0-Day Ad Change?
Three decisions follow from the records, and each is tied to a mechanism we observed.
- Rank web and CMS assets by exposure, not by label. Web software is the largest stated target class (43%), and one June ad named a CVE suffix matching an entry added to the catalogue 41 days earlier. Mass-exploitation tools run against lists of addresses, so the patch queue for public CMS sites, plugins and hosting panels matters more than any “0-day” label. CISA advises using its catalogue as an input to vulnerability management priorities.
- Triage a “0-day for sale” claim about your product with three checks. Does the post name a version, a CVE or a checkable detail? Is there a current vendor advisory or catalogue entry for that product? If so, patch by the advisory, whatever the label says; if neither exists, log the claim, tell the product owner and do not treat it as a confirmed vulnerability.
- Hunt for the resulting web shells. Web shells are the output of several exploitation tools. One seller prices them by the authority score of the compromised site, so a well-ranked domain is worth more to them (XT-E026). After patching, check public sites for planted web shells.
Product names alone cannot tie a claim to a vulnerability. Three listings named a hosting panel or a business-intelligence tool without a CVE. Each fell within a day of a catalogue entry for the same product, so we draw no link between them (XT-E016, XT-E017, XT-E028).
Patch edge devices according to the vendor’s advisories and the catalogue’s remediation schedule, because this slice cannot tell you how exposed they are. For background, see our entries on zero-day vulnerabilities and patch management, and our ransomware leak-site claims study.
Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.
Brandefense analysts reviewed and approved the findings.
