Pure Storage FlashArray CVE-2026-6445

The attacker must possess valid authenticated credentials at a low privilege level on the FlashArray Purity management interface (CVSS PR:L), and must have network reachability to that interface (AV:N) - typically a management VLAN or directly exposed array endpoint. No user interaction is required (UI:N) and attack complexity is low (AC:L), but exploitation is limited to Purity versions 6.5.0-6.5.8 and 6.10.0-6.10.5; arrays on 6.5.9+ or 6.10.6+ (or other Purity trains) are out of scope per EUVD. Risk is further bounded by the fact that exposure requires an existing authenticated foothold, so environments with strict RBAC, MFA on Purity accounts, and isolated management networks materially reduce realistic exploitability.

Signals are mixed: CVSS 4.0 rates the issue 8.7 (High) driven by network attack vector, low complexity, low privileges, and high impact across all three confidentiality, integrity, and availability dimensions, yet the original description characterizes the impact as information exposure rather than write/destroy. SSVC counterbalances the CVSS with 'Exploitation: none' and 'Automatable: no', and there is no CISA KEV listing or public POC, meaning no evidence of in-the-wild activity. The CVSS VI:H/VA:H ratings appear inconsistent with a pure information-disclosure flaw described in the text - defenders should verify with Pure Storage whether the disclosed data enables follow-on integrity or availability impact, or whether the vector overstates the consequence. Because exploitation requires an authenticated account on the storage array, real-world risk is concentrated at organizations with broad admin access to FlashArray management planes; for hardened environments with tight RBAC this is a moderate-priority patch, while for environments with shared low-privilege accounts it warrants urgent remediation.

An attacker who has obtained a low-privilege Purity account - for example a read-only monitoring credential leaked from a CI system or a help-desk operator account - issues crafted requests against the FlashArray management interface and receives data that should be restricted to administrators, such as volume contents metadata, replication targets, or credential material. With no public POC identified, exploitation today would require independent vulnerability research or vendor-detail leakage; SSVC rates the issue as not automatable, so mass scanning is unlikely.