Where
AND
-Infinity
0
Severity
9.1
Command Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP configuration.

Remedy

Affected customers will need to apply a self-service patch bundle or upgrade their Purity to an unaffected Purity version. This issue is resolved in the following FlashArray Purity releases: * Purity//FA versions 6.3.15 or later * Purity//FA versions 6.5.1 or later * Purity//FA versions 6.6.1 or later. This issue is resolved in the following FlashBlade Purity releases: * Purity//FB versions 4.1.12 or later * Purity//FB versions 4.3.2 or later
First published (updated )
Severity
9.1
Code Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.

Remedy

Affected customers will need to apply a self-service patch bundle or upgrade their Purity to an unaffected Purity version. This issue is resolved in the following FlashArray Purity releases: * Purity//FA versions 6.3.15 or later * Purity//FA versions 6.5.1 or later * Purity//FA versions 6.6.1 or later.
First published (updated )
Severity
9.1
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privileged access.

Remedy

Affected customers will need to apply a self-service patch bundle or upgrade their Purity to an unaffected Purity version. This issue is resolved in the following FlashArray Purity releases: * Purity//FA versions 6.3.15 or later * Purity//FA versions 6.5.1 or later * Purity//FA versions 6.6.1 or later.
First published (updated )
Severity
10
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.

Remedy

Affected customers will need to apply a self-service patch bundle or upgrade their Purity to an unaffected Purity version. This issue is resolved in the following FlashArray Purity releases: * Purity//FA versions 6.3.15 or later * Purity//FA versions 6.5.1 or later * Purity//FA versions 6.6.1 or later.
First published (updated )
Severity
10
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor to gain elevated privileges.

Remedy

Affected customers will need to apply a self-service patch bundle or upgrade their Purity to an unaffected Purity version. This issue is resolved in the following FlashArray Purity releases: * Purity//FA versions 6.3.15 or later  * Purity//FA versions 6.5.1 or later  * Purity//FA versions 6.6.1 or later.
First published (updated )
Severity
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.

Remedy

This issue is resolved in FlashArray Purity (OE) versions 6.3.12 and later, 6.4.6 and later. 
First published (updated )
Severity
6.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection.

Remedy

This issue is resolved in FlashArray Purity (OE) versions 6.3.8 and later, 6.4.3 and later. 
First published (updated )
Severity
4.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system including snapshots protected by SafeMode.

Remedy

This issue is resolved in FlashArray Purity (OE) versions 6.1.23 or later, 6.2.16 or later, 6.3.7 or later, 6.4.1 or later
First published (updated )

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203