# RA-2026-043-01

- **Artifact ID:** RA-2026-043-01
- **Status:** VALID
- **Public record:** https://record.cybersecurityhq.com/rating-actions/ra-2026-043-01
- **Machine-record SHA-256:** `a19ce3983986bc3326adef968adb8e50ff9a3000d97a520003453e964c159db4`

## Complete structured record

```json
{
  "id": "RA-2026-043-01",
  "date": "2026-10-19",
  "issue": "Issue No. 43",
  "condition": "SC-2026-006",
  "action": "COUNTED: Ivanti CVE-2026-104935 counted as instance #6",
  "from": "CONFIRMED (5 at 5 vendors before this batch)",
  "to": "CONFIRMED (unchanged; count +1)",
  "outlook": "Accumulating",
  "watch": "none",
  "criterion_version": "SC-2026-006 v2.0 + C1",
  "methodology_version": "v1.3",
  "evidence_rows": [
    "SN-2026-10-14-01"
  ],
  "grades": "Exploitation B (Volexity responder log, one customer); disclosure A (vendor advisory, catalog)",
  "independence_determination": "New vendor; distinct causal run; independent sources for the two dates",
  "rule_applied": "CRITERION QUOTED (SC-2026-006 v2.0, validation record 16 Sep 2026, CGS-1.3): Clarification C1 (6 Oct): T_disclosure = first public statement identifying the vulnerable product and affected versions. CGS-2.5a: required propositions may be established by different admissible sources. CGS-1.5: a label without a date does not satisfy the observable; T_disclosure is the earliest public disclosure by any party. STEPS: (1) confirmed-exploitation entry: CISA KEV 2026-10-13, Grade A. (2) T_exploitation 2026-10-03, documented by Volexity (incident-response report with direct observation, Grade B under CGS-2.2):. (3) T_disclosure 2026-10-13, Ivanti advisory (Grade A) and catalog; no earlier public statement by any party located. (4) 3 Oct < 13 Oct: qualifying, gap 10 days. (5) Sources for the two dates differ (responder; vendor and catalog): CGS-3.3 satisfied. (6) New vendor, distinct causal run: instance #6. INTERPRETATION RECORDED: the criterion requires one admissible source per date, recorded independently (CGS-3.3; CGS-2.5a), not independent corroboration of each date; a vendor-documented exploitation date is admissible on the text. Alternative stricter reading (independent confirmation of the exploitation timestamp) would not fully admit BeyondTrust; the reproduction tests the reading the criterion states.",
  "alternative_not_taken": "Hold pending Ivanti confirmation of the exploitation date (not taken: responder log is a dated primary and the criterion does not require vendor confirmation)",
  "cgs_provisions": "CGS-2.2 (source class), CGS-3.3 (evidence grade), CGS-5 (counting)",
  "record_links": "CHQ-RAT-2026-043; the signal ledger SN-2026-10-14-01",
  "status": "VALID",
  "admission_status": "Counted; provisionally accepted, independent reproduction overdue (exception CHQ-STAB-2026-001-EXC-1, review 26 October, closure 2 November 2026)",
  "blind_reproduction": "OWED",
  "reproduction_result": null,
  "supersedes_admission_status": null
}
```