CVE-2026-0209: Medium severity Pure Storage FlashArray Purity vulnerability
Published Apr 14, 2026
·Updated
Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured.
Affected Software
1 affected component
Pure Storage FlashArray Purity
Remediation
Information
This issue is resolved in the following FlashArray //Purity versions: * Purity//FA 6.5.13 or later
* Purity//FA 6.7.7 or later
* Purity//FA 6.9.2 or later
* Purity//FA 6.10.1 or later
Event History
Apr 14, 2026
CVE Published
via MITRE·05:52 PM
Data Sourced
via MITRE·05:52 PM
RemedyDescriptionWeakness
Data Sourced
via NVD·06:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-0209?
CVE-2026-0209 is classified as a medium severity vulnerability.
2
How do I fix CVE-2026-0209?
To fix CVE-2026-0209, ensure your FlashArray Purity software is updated to the latest version that addresses this issue.
3
What are the potential consequences of CVE-2026-0209?
The consequences of CVE-2026-0209 include incorrect application of snapshot retention policies, potentially resulting in data loss or retention issues.
4
In which conditions is CVE-2026-0209 applicable?
CVE-2026-0209 is applicable under specific administrative configurations within the FlashArray Purity environment.
5
Has CVE-2026-0209 been publicly disclosed?
Yes, CVE-2026-0209 has been publicly disclosed and documented in security bulletins.