Helix Ultimate CVE-2026-57829

Exploitation requires an unauthenticated attacker (PR:N) to reach a Helix Ultimate input surface that stores content later rendered into the template, and - critically - a victim must subsequently view the affected page for the stored script to execute (UI:P, passive user interaction). The exploit is limited by this user-interaction requirement (the payload does not fire autonomously and yields its highest impact only when the viewer is a privileged/administrative user) and by the need for the affected Helix Ultimate rendering path to be present and reachable; the exact vulnerable input field and any version or configuration constraints are not specified in the available data and should be confirmed with the vendor.

The CVSS 4.0 base score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H, indicating a network-reachable, low-complexity, unauthenticated injection whose payload fires only when a victim views the content (user interaction required). The high VC/VI/VA ratings reflect the impact of script execution in a privileged victim's session rather than direct server compromise; the passive user-interaction requirement is the main limiting factor and typically lowers real-world urgency versus a fully autonomous exploit. No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so exploitation probability cannot be quantified from the input - this appears to be a genuinely high-severity but not-yet-actively-exploited issue rather than an imminent mass-exploitation event. Note the assessment relies solely on the vendor-supplied CVSS vector and a one-line description; independent corroboration of the injection point is not available.

An attacker submits crafted input containing a JavaScript payload to an unauthenticated Helix Ultimate input surface, where it is stored and later served within the site's template markup. When a site administrator or other privileged user opens the affected page, the script executes in their browser session, allowing the attacker to steal the session cookie or CSRF token and act as that user. No public exploit code has been identified, and successful execution depends on a victim viewing the poisoned page (UI:P).