Maybe things have changed in recent years but here's some information on what I considered benchmark prices when I was more involved in this kind of thing. I ha

Maybe things have changed in recent years but here's some information on what I considered benchmark prices when I was more involved in this kind of thing. I have some background in vulnerability selling and I used to do this for a living (first government, then later tech company bug bounty programs). The "grey market" prices I've seen (~5 years ago now) from independent researchers, small firms specializing in vulndev for law enforcement / intelligence and the bigger famous security firms go something like this ("black market" criminal markets are similar I hear but I have no first hand knowledge there): 250k would get you a iOS jailbreak (for a recent iOS version) 100k would get you an IE/Firefox/Chrome zero day (though not with a sanbox escape, you'd have to pay separately for a privesc) ~25k for a Linux privesc For an RCEs in medium popularity services (databases, ftp servers, etc) you'd be looking at something like 10k (or often thrown in free with a bigger purchase or support contract as a good will gesture). The prices would also change based on the quality of the exploit, how recent the version the exploit targeted was, the amount of exclusivity you want (more for full exclusivity) and whether the research was specially commissioned (if you had asked a firm to look into a specific piece of software the price would be higher). The larger providers also encouraged organizations to sign subscription deals and longer term service contracts that could include free exploits or reduced costs. That said, there's a lot of information asymmetry in the market so I'd expect a lot of variance in prices.