PureStorage

Latest CVEs · RSS

• CVE-2026-0207 2026-04-14 · CVSS 8.5
  A vulnerability exists in FlashBlade whereby sensitive information may be logged under specific conditions.
• CVE-2026-0209 2026-04-14 · CVSS 6.9
  Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured.
• CVE-2025-9127 2025-12-04 · CVSS 8.4
  A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions.
• CVE-2025-2327 2025-06-16 · CVSS 5.1
  A flaw exists in FlashArray whereby the Key Encryption Key (KEK) is logged during key rotation when RDL is configured.
• CVE-2025-0052 2025-06-10 · CVSS 8.3
  Improper input validation performed during the authentication process of FlashBlade could lead to a system Denial of Service.
• CVE-2025-0051 2025-06-10 · CVSS 8.7
  Improper input validation performed during the authentication process of FlashArray could lead to a system Denial of Service.
• CVE-2025-1308 2025-05-19 · CVSS 8.4
  A vulnerability exists in PX Backup whereby sensitive information may be logged under specific conditions.
• CVE-2024-3057 2024-10-08 · CVSS 9.8
  A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation.
• CVE-2024-0005 2024-09-23 · CVSS 9.1
  A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP co
• CVE-2024-0004 2024-09-23 · CVSS 9.1
  A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.
• CVE-2024-0003 2024-09-23 · CVSS 9.1
  A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privileged
• CVE-2024-0002 2024-09-23 · CVSS 10.0
  A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.
• CVE-2024-0001 2024-09-23 · CVSS 10.0
  A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor t
• CVE-2023-4976 2024-07-17 · CVSS 9.3
  A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker
• CVE-2023-36628 2023-10-02 · CVSS 8.8
  A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.
• CVE-2023-32572 2023-10-02 · CVSS 6.5
  A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeM
• CVE-2023-28373 2023-10-02 · CVSS 4.4
  A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system inclu
• CVE-2023-36627 2023-10-02 · CVSS 7.7
  A flaw exists in FlashBlade Purity whereby a user with access to an administrative account on a FlashBlade that is configured with timezone-dependent snapshot s
• CVE-2023-31042 2023-10-02 · CVSS 7.7
  A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s d
• CVE-2023-28372 2023-10-02 · CVSS 6.5
  A flaw exists in FlashBlade Purity (OE) Version 4.1.0 whereby a user with privileges to extend an object’s retention period can affect the availability of the