CVE-2026-0209

FlashArray Purity is Pure Storage's data management and protection layer for all-flash arrays, responsible for enforcing snapshot lifecycle policies including retention, replication, and deletion schedules. The vulnerability resides in the policy application scheduling logic (CWE-783: Operator Precedence Logic Error), where conditional logic or arithmetic calculations governing policy trigger timing produce incorrect execution windows. This affects the temporal consistency of snapshot operations across the storage platform, potentially causing snapshots to be retained beyond their intended deletion window or prematurely removed before the configured hold period expires. The issue manifests under specific administrative configurations that interact with the policy scheduler in unexpected ways.