# RA-2026-043-02

- **Artifact ID:** RA-2026-043-02
- **Status:** VALID
- **Public record:** https://record.cybersecurityhq.com/rating-actions/ra-2026-043-02
- **Machine-record SHA-256:** `61d2f4f98000c0942dfd1532f55e017863e0efe9ea24f0ae8405678a399f8ac4`

## Complete structured record

```json
{
  "id": "RA-2026-043-02",
  "date": "2026-10-19",
  "issue": "Issue No. 43",
  "condition": "SC-2026-006",
  "action": "COUNTED: BeyondTrust CVE-2026-102764 counted as instance #7",
  "from": "CONFIRMED (6 at 6 vendors after #6)",
  "to": "CONFIRMED (unchanged; count +1)",
  "outlook": "Accumulating",
  "watch": "none",
  "criterion_version": "SC-2026-006 v2.0 + C1",
  "methodology_version": "v1.3",
  "evidence_rows": [
    "SN-2026-10-17-01"
  ],
  "grades": "Exploitation A (vendor primary with independent responder observation at the self-hosted victim); disclosure A (vendor advisory, catalog, watchTowr); 15 Oct provisional on the 8 Oct public-statement question",
  "independence_determination": "New vendor; distinct causal run; two dates on different sources: exploitation (vendor chronology; Mandiant independently establishes exploitation at the self-hosted victim and a late-August start; 29 Aug day-precision vendor-only), disclosure (advisory + catalog + watchTowr); press repetition excluded",
  "rule_applied": "CRITERION QUOTED (SC-2026-006 v2.0, validation record 16 Sep 2026, CGS-1.3): Clarification C1 (6 Oct): T_disclosure = first public statement identifying the vulnerable product and affected versions. CGS-2.5a: required propositions may be established by different admissible sources. CGS-1.5: a label without a date does not satisfy the observable; T_disclosure is the earliest public disclosure by any party. STEPS: (1) confirmed-exploitation entry: CISA KEV 2026-10-16, Grade A. (2) T_exploitation 2026-08-29, documented by the vendor in its advisory BT26-05 and chronology post of 15 Oct (vendor security advisory, Grade A under CGS-2.1): exploitation of one hosted and one self-hosted instance on 29 Aug. The criterion admits a vendor-documented exploitation date; it does not require a second source for the same date. Mandiant independently establishes exploitation at the self-hosted victim (findings shared 30 Sep) and a late-August start in its public analysis; the day-precision rests on the vendor and is recorded as such. (3) T_disclosure 2026-10-15, advisory BT26-05, catalog 16 Oct, watchTowr 16 Oct; provisional: whether the 8 Oct patch release carried a public statement identifying product and versions is not established (vendor: technical details withheld until 15 Oct). (4) 29 Aug < 15 Oct (and < 8 Oct on the alternative): qualifying, gap 47 (or 40) days. (5) Sources for the two dates differ (vendor chronology for exploitation; advisory, catalog and third party for disclosure): CGS-3.3 satisfied; CGS-2.5a applied. (6) New vendor, distinct causal run: instance #7. INTERPRETATION RECORDED: the criterion requires one admissible source per date, recorded independently (CGS-3.3; CGS-2.5a), not independent corroboration of each date; a vendor-documented exploitation date is admissible on the text. Alternative stricter reading (independent confirmation of the exploitation timestamp) would not fully admit BeyondTrust; the reproduction tests the reading the criterion states.",
  "alternative_not_taken": "Hold pending vendor primary (not taken: four concurring sources on the disclosure date and the qualification does not depend on the 8 Oct question)",
  "cgs_provisions": "CGS-2.2 (source class), CGS-3.3 (evidence grade), CGS-5 (counting)",
  "record_links": "CHQ-RAT-2026-043; the signal ledger SN-2026-10-17-01",
  "status": "VALID",
  "admission_status": "Counted; provisionally accepted, independent reproduction overdue (exception CHQ-STAB-2026-001-EXC-1, review 26 October, closure 2 November 2026)",
  "blind_reproduction": "OWED",
  "reproduction_result": null,
  "supersedes_admission_status": null
}
```