Pre-Disclosure Exploitation: RA-2026-043-02

RA-2026-043-02

Machine-readable record

id

RA-2026-043-02

date

2026-10-19

issue

Issue No. 43

condition

SC-2026-006

action

COUNTED: BeyondTrust CVE-2026-102764 counted as instance #7

from

CONFIRMED (6 at 6 vendors after #6)

to

CONFIRMED (unchanged; count +1)

outlook

Accumulating

watch

none

criterion version

SC-2026-006 v2.0 + C1

methodology version

v1.3

evidence rows

SN-2026-10-17-01

grades

Exploitation A (vendor primary with independent responder observation at the self-hosted victim); disclosure A (vendor advisory, catalog, watchTowr); 15 Oct provisional on the 8 Oct public-statement question

independence determination

New vendor; distinct causal run; two dates on different sources: exploitation (vendor chronology; Mandiant independently establishes exploitation at the self-hosted victim and a late-August start; 29 Aug day-precision vendor-only), disclosure (advisory + catalog + watchTowr); press repetition excluded

rule applied

CRITERION QUOTED (SC-2026-006 v2.0, validation record 16 Sep 2026, CGS-1.3): Clarification C1 (6 Oct): T_disclosure = first public statement identifying the vulnerable product and affected versions. CGS-2.5a: required propositions may be established by different admissible sources. CGS-1.5: a label without a date does not satisfy the observable; T_disclosure is the earliest public disclosure by any party. STEPS: (1) confirmed-exploitation entry: CISA KEV 2026-10-16, Grade A. (2) T_exploitation 2026-08-29, documented by the vendor in its advisory BT26-05 and chronology post of 15 Oct (vendor security advisory, Grade A under CGS-2.1): exploitation of one hosted and one self-hosted instance on 29 Aug. The criterion admits a vendor-documented exploitation date; it does not require a second source for the same date. Mandiant independently establishes exploitation at the self-hosted victim (findings shared 30 Sep) and a late-August start in its public analysis; the day-precision rests on the vendor and is recorded as such. (3) T_disclosure 2026-10-15, advisory BT26-05, catalog 16 Oct, watchTowr 16 Oct; provisional: whether the 8 Oct patch release carried a public statement identifying product and versions is not established (vendor: technical details withheld until 15 Oct). (4) 29 Aug < 15 Oct (and < 8 Oct on the alternative): qualifying, gap 47 (or 40) days. (5) Sources for the two dates differ (vendor chronology for exploitation; advisory, catalog and third party for disclosure): CGS-3.3 satisfied; CGS-2.5a applied. (6) New vendor, distinct causal run: instance #7. INTERPRETATION RECORDED: the criterion requires one admissible source per date, recorded independently (CGS-3.3; CGS-2.5a), not independent corroboration of each date; a vendor-documented exploitation date is admissible on the text. Alternative stricter reading (independent confirmation of the exploitation timestamp) would not fully admit BeyondTrust; the reproduction tests the reading the criterion states.

alternative not taken

Hold pending vendor primary (not taken: four concurring sources on the disclosure date and the qualification does not depend on the 8 Oct question)

cgs provisions

CGS-2.2 (source class), CGS-3.3 (evidence grade), CGS-5 (counting)

record links

CHQ-RAT-2026-043; the signal ledger SN-2026-10-17-01

status

VALID

admission status

Counted; provisionally accepted, independent reproduction overdue (exception CHQ-STAB-2026-001-EXC-1, review 26 October, closure 2 November 2026)

blind reproduction

OWED

reproduction result

Not recorded

supersedes admission status

Not recorded