Pre-Disclosure Exploitation: RA-2026-043-01

RA-2026-043-01

Machine-readable record

id

RA-2026-043-01

date

2026-10-19

issue

Issue No. 43

condition

SC-2026-006

action

COUNTED: Ivanti CVE-2026-104935 counted as instance #6

from

CONFIRMED (5 at 5 vendors before this batch)

to

CONFIRMED (unchanged; count +1)

outlook

Accumulating

watch

none

criterion version

SC-2026-006 v2.0 + C1

methodology version

v1.3

evidence rows

SN-2026-10-14-01

grades

Exploitation B (Volexity responder log, one customer); disclosure A (vendor advisory, catalog)

independence determination

New vendor; distinct causal run; independent sources for the two dates

rule applied

CRITERION QUOTED (SC-2026-006 v2.0, validation record 16 Sep 2026, CGS-1.3): Clarification C1 (6 Oct): T_disclosure = first public statement identifying the vulnerable product and affected versions. CGS-2.5a: required propositions may be established by different admissible sources. CGS-1.5: a label without a date does not satisfy the observable; T_disclosure is the earliest public disclosure by any party. STEPS: (1) confirmed-exploitation entry: CISA KEV 2026-10-13, Grade A. (2) T_exploitation 2026-10-03, documented by Volexity (incident-response report with direct observation, Grade B under CGS-2.2):. (3) T_disclosure 2026-10-13, Ivanti advisory (Grade A) and catalog; no earlier public statement by any party located. (4) 3 Oct < 13 Oct: qualifying, gap 10 days. (5) Sources for the two dates differ (responder; vendor and catalog): CGS-3.3 satisfied. (6) New vendor, distinct causal run: instance #6. INTERPRETATION RECORDED: the criterion requires one admissible source per date, recorded independently (CGS-3.3; CGS-2.5a), not independent corroboration of each date; a vendor-documented exploitation date is admissible on the text. Alternative stricter reading (independent confirmation of the exploitation timestamp) would not fully admit BeyondTrust; the reproduction tests the reading the criterion states.

alternative not taken

Hold pending Ivanti confirmation of the exploitation date (not taken: responder log is a dated primary and the criterion does not require vendor confirmation)

cgs provisions

CGS-2.2 (source class), CGS-3.3 (evidence grade), CGS-5 (counting)

record links

CHQ-RAT-2026-043; the signal ledger SN-2026-10-14-01

status

VALID

admission status

Counted; provisionally accepted, independent reproduction overdue (exception CHQ-STAB-2026-001-EXC-1, review 26 October, closure 2 November 2026)

blind reproduction

OWED

reproduction result

Not recorded

supersedes admission status

Not recorded