Advisory ID: BWD-2026-003
Published: January 15, 2026
Last Updated: January 15, 2026
Severity: Medium
CVSS Base Score: 5.3
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CWE: CWE-358
CVE: CVE-2025-62002
Description
Helm Ransomware Containment considers the number of files modified to trigger detection. An authenticated attacker could encrypt a single (possibly large) file without triggering detection if thresholds are configured to require multiple file changes. The number of files to trigger detection can be configured by the user. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions may also be affected.
Impact
Confidentiality: No Impact
Integrity: No Impact
Availability: No Impact
Affected Products and Versions
Product / Components: Helm RC
Affected Versions: Versions < 4.6.1.4
Fixed Versions: 4.6.1.14
Solution
This behavior is driven by configurable thresholds.
Helm can be configured to trigger on single-file encryption, and customers routinely tune thresholds based on operational tolerance for noise.
The advisory wording may suggest an inherent inability to detect single-file encryption, which is not accurate.
Mitigations / Workarounds
Adjust detection sensors thresholds to improve sensor sensitvity level
Configure additional detecion sensor dedicated to critical documents
Detections
Helm does not currently provide a detection for this issue.
Acknowledgements
Helm thanks the reporter for responsibly disclosing this issue.
This advisory is provided for informational purposes only. Customers should evaluate applicability based on their specific environment. To report a security vulnerability, contact security@helmsecurity.ai.
