Jul 6, 2026 08:01 PM
(This post was last modified: Jul 6, 2026 08:07 PM by Oxycodone.)
Contract must be started on site for serious inquires.
If you want to see a demonstration (live) we can arrange it.
Middle man is accepted obviously. Preferably someone who we both agree on, and understands code, as well as how these things work.
This is meant for research purposes only, for you to get a major leap in a door as a security researcher and improve your resume.
My job isn't in the field of security research, so this won't do me any benefit in claiming it for myself.
The vendor has a bug bounty program, although this is out of scope. I'm sure they will still work with you. Have legal team ready just incase ahead of time due to the nature of it being out of scope.
You will get everything needed, documentation, the software / code to setup a personal environment for testing, the 0 Day Proof of Concept and I will have help you review all the material, walk you through the code step by step so you are 100% understanding of how it works inside and out.
I will ensure you knowledge f the entire software is understood, maybe you can find more exploits.
So this does not affect any humanitarian services. It does not affect any medical or health care services. This is not something you'd use for a botnet as the total locations are limited to around 10,000. It's the perfect vulnerability to put on your resume.
What is it?
Primarily a 1-Click Remote Code Execution Pre-authenticated 0 Day. The app is installed with admin rights, allowing for any execution from this app to bypass UAC as well. I discovered it on July 1st 2026. (Or I should say , YOU discovered it.)
This was an only tested 100% in a controlled environment, never against any targets I didn't legally own myself.
There is no special settings required for this to work. From my knowledge every version for the last few years till now is vulnerable.
The vulnerability actually occurs in more places then one, and makes it harder to probably patch then you would assume, giving it a lot more reason to why they would want to take interest in it.
Or, You could just submit a CVE Properly and not notify the vendor directly.
If accessed on a local network or on a local network, or if the enterprise system is expose to the internet it can then be a 0 click remote code execution.
Professionals only.
It's not hard to tell who is asking questions, and what their intent is just by the way they ask the questions.
This isn't something that would be useful weaponized, so don't even bother hitting me up if thats your intention.
Contract is a must, will show proof and discuss things further with serious client sonly.
Only selling it to 1 person.
This again is a perfect thing to put on one's security research resume, and portfolio. It will definitely look great for years to come.
This sales thread is not meant to encourage abuse, or weaponization of anything.This is clearly stated many times for a reason.
If this exploit, was something that would be even accidentally sold to the wrong person, let alone abused by weaponizing it, then I wouldn't be posting this.
I have strong belief this is not something worth weaponizing, so please don't waste your time or mine by trying to figure more out about it just to come to the sam answers I keep on stating.
PM Me.
Contract only.
Middle man allowed.
I have evidence and videos to show, and this is 100% reliable. It happens every time without a crash. So I have no problem doing a live demo if you're ready to purchase it.
0 Day Makes this sound like a crazy find, but it's just sub 10,000 user software that is private enterprise focused. It's something that would be appreciated by the business, not something of interest outside of that.
Thank you.
I will also request a contract to be digitally signed, just for my records that the transfer of this is under pure understanding of research only, and not intended to cause nay distress, or financial harm, or be used for any malicious intent. It might not save me from legality if I get fucked over for this. I just want there to be proof there was a honest mutual understanding and everything in good faith is properly discussed during review before singing and closing the dal.
Crowdfense is taking to long to respond.
Thats the only reason I'm just gonna take a loss and sell it for a lot less now.
Start Contract
If you want to see a demonstration (live) we can arrange it.
Middle man is accepted obviously. Preferably someone who we both agree on, and understands code, as well as how these things work.
This is meant for research purposes only, for you to get a major leap in a door as a security researcher and improve your resume.
My job isn't in the field of security research, so this won't do me any benefit in claiming it for myself.
The vendor has a bug bounty program, although this is out of scope. I'm sure they will still work with you. Have legal team ready just incase ahead of time due to the nature of it being out of scope.
You will get everything needed, documentation, the software / code to setup a personal environment for testing, the 0 Day Proof of Concept and I will have help you review all the material, walk you through the code step by step so you are 100% understanding of how it works inside and out.
I will ensure you knowledge f the entire software is understood, maybe you can find more exploits.
So this does not affect any humanitarian services. It does not affect any medical or health care services. This is not something you'd use for a botnet as the total locations are limited to around 10,000. It's the perfect vulnerability to put on your resume.
What is it?
Primarily a 1-Click Remote Code Execution Pre-authenticated 0 Day. The app is installed with admin rights, allowing for any execution from this app to bypass UAC as well. I discovered it on July 1st 2026. (Or I should say , YOU discovered it.)
This was an only tested 100% in a controlled environment, never against any targets I didn't legally own myself.
There is no special settings required for this to work. From my knowledge every version for the last few years till now is vulnerable.
The vulnerability actually occurs in more places then one, and makes it harder to probably patch then you would assume, giving it a lot more reason to why they would want to take interest in it.
Or, You could just submit a CVE Properly and not notify the vendor directly.
If accessed on a local network or on a local network, or if the enterprise system is expose to the internet it can then be a 0 click remote code execution.
Professionals only.
It's not hard to tell who is asking questions, and what their intent is just by the way they ask the questions.
This isn't something that would be useful weaponized, so don't even bother hitting me up if thats your intention.
Contract is a must, will show proof and discuss things further with serious client sonly.
Only selling it to 1 person.
This again is a perfect thing to put on one's security research resume, and portfolio. It will definitely look great for years to come.
This sales thread is not meant to encourage abuse, or weaponization of anything.This is clearly stated many times for a reason.
If this exploit, was something that would be even accidentally sold to the wrong person, let alone abused by weaponizing it, then I wouldn't be posting this.
I have strong belief this is not something worth weaponizing, so please don't waste your time or mine by trying to figure more out about it just to come to the sam answers I keep on stating.
PM Me.
Contract only.
Middle man allowed.
I have evidence and videos to show, and this is 100% reliable. It happens every time without a crash. So I have no problem doing a live demo if you're ready to purchase it.
0 Day Makes this sound like a crazy find, but it's just sub 10,000 user software that is private enterprise focused. It's something that would be appreciated by the business, not something of interest outside of that.
Thank you.
I will also request a contract to be digitally signed, just for my records that the transfer of this is under pure understanding of research only, and not intended to cause nay distress, or financial harm, or be used for any malicious intent. It might not save me from legality if I get fucked over for this. I just want there to be proof there was a honest mutual understanding and everything in good faith is properly discussed during review before singing and closing the dal.
Crowdfense is taking to long to respond.
Thats the only reason I'm just gonna take a loss and sell it for a lot less now.
Start Contract