Executive brief
A security vulnerability has been identified in the management interface of Pure Storage FlashArray devices, which are used for high-performance data storage. An individual with low-level access to the system could bypass security restrictions to perform actions or access data they are not authorized to see. This could lead to unauthorized changes to storage configurations or the exposure of sensitive business information.
Technical details
An authorization bypass vulnerability (CWE-639) exists in the Pure Storage FlashArray Purity management interface. The flaw allows an authenticated user with low privileges to bypass authorization checks, potentially through user-controlled keys or parameters, to access administrative or high-privilege functionality. The attack is reachable over the network and does not require user interaction, though it does require valid low-privileged credentials. Successful exploitation can result in high impacts to confidentiality and integrity of the storage array management.
Affected products
- Pure Storage FlashArray Purity
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory