CVE-2026-6444: High severity Pure Storage FlashArray Purity vulnerability
A flaw exists in the FlashArray Purity management interface where an authenticated low-privileged user may, under specific conditions, access functionality beyond their assigned privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Review all user accounts and role assignments in the FlashArray Purity management interface. Correct any roles or permissions that grant functionality beyond the intended privileges and ensure low-privileged users have only the minimum required permissions.
FlashArray Purity management interface user role / privileges = enforce least-privilege; remove excessive privileges from low-privileged accounts - Compensating control
Restrict network access to the FlashArray Purity management interface to trusted IPs, management VLANs, or via VPN. Apply firewall/ACL rules to limit which hosts can reach the management interface and restrict administrative access to known administrators.
- Operational
Audit management interface logs and recent user activity for signs of unauthorized use of elevated functionality. Disable or remediate any accounts observed performing unauthorized actions and, if appropriate, rotate or reset credentials for impacted accounts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6444?
The severity of CVE-2026-6444 is high with a CVSS score of 8.6.
How do I fix CVE-2026-6444?
To fix CVE-2026-6444, you should apply the latest patches provided by Pure Storage for the FlashArray Purity management interface.
Who is affected by CVE-2026-6444?
Authenticated low-privileged users of the Pure Storage FlashArray Purity management interface are affected by CVE-2026-6444.
What type of vulnerability is CVE-2026-6444?
CVE-2026-6444 is a privilege escalation vulnerability in the FlashArray Purity management interface.
What can an attacker do with CVE-2026-6444?
An attacker can potentially access functionality beyond their assigned privileges due to CVE-2026-6444.