CVE-2026-6445: High severity Pure Storage FlashArray Purity vulnerability
A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to FlashArray Purity management interfaces and APIs to trusted management networks, VPNs, or specific IP allowlists to limit which authenticated users can reach the product.
- Compensating control
Enforce least-privilege on FlashArray Purity accounts: review roles and permissions, disable or remove unnecessary authenticated accounts (including low-privilege accounts) and restrict which roles can access data-paths that may expose sensitive information.
- Operational
Audit access logs and configuration on FlashArray Purity for evidence of sensitive-information access by low-privilege users; if exposure is detected perform incident response actions appropriate for your organization (containment, remediation, and notification).
- Operational
Monitor vendor (FlashArray Purity) advisories and release notes and apply any vendor-provided fixes or mitigations as soon as they become available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6445?
CVE-2026-6445 has a high severity rating of 8.7.
How do I fix CVE-2026-6445?
To fix CVE-2026-6445, it is recommended to apply the latest security patches provided by Pure Storage for FlashArray Purity.
What type of information is affected by CVE-2026-6445?
CVE-2026-6445 can expose sensitive information to authenticated users with low privileges due to insufficient data path filtering.
Who is at risk from CVE-2026-6445?
Authenticated users with low privileges on Pure Storage FlashArray Purity systems are at risk from CVE-2026-6445.
When was CVE-2026-6445 published?
CVE-2026-6445 was published on June 9, 2026.