CVE-2026-6444

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in FlashArray Purity Management Interface

Publication date: 2026-06-09

Last updated on: 2026-06-09

Assigner: Pure Storage, Inc.

Description

A flaw exists in the FlashArray Purity management interface where an authenticated low-privileged user may, under specific conditions, access functionality beyond their assigned privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-09

Last Modified

2026-06-09

Generated

2026-06-30

AI Q&A

2026-06-10

EPSS Evaluated

2026-06-28

NVD

CVE-2026-6444

EUVD

EUVD-2026-35793

Affected Vendors & Products

Vendor	Product	Version / Range
purestorage	flasharray_purity	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the FlashArray Purity management interface. It allows an authenticated user with low privileges to access functionality that is beyond their assigned permissions under certain specific conditions.

Impact Analysis

The impact of this vulnerability is that a low-privileged authenticated user could potentially perform actions or access features that should be restricted, which could lead to unauthorized changes or exposure of sensitive management functions.

Compliance Impact

The vulnerability allows an authenticated low-privileged user to access functionality beyond their assigned privileges in the FlashArray Purity management interface.

Such unauthorized privilege escalation could potentially lead to unauthorized access to sensitive data or management functions, which may impact compliance with standards and regulations like GDPR and HIPAA that require strict access controls and protection of sensitive information.

However, no specific information about the direct impact on compliance with these standards is provided in the available resources.

Hi! I’m here to help you understand CVE-2026-6444. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70