CVE-2026-6444: FlashArray Purity Privilege Escalation Flaw

CVE-2026-6444 Overview

CVE-2026-6444 is an authorization bypass vulnerability in the Pure Storage FlashArray Purity management interface. An authenticated low-privileged user can, under specific conditions, access functionality reserved for higher-privileged roles. The flaw is classified as [CWE-639] Authorization Bypass Through User-Controlled Key. The issue affects the Purity management plane used to administer FlashArray storage systems. Pure Storage published details through its security bulletins portal.

Critical Impact
An authenticated low-privileged user can perform actions outside their assigned role, leading to unauthorized access to administrative functionality and stored data on FlashArray Purity systems.

Affected Products

Pure Storage FlashArray running the Purity operating environment
Purity management interface (administrative web/API plane)
Refer to the Pure Storage security bulletin for specific affected Purity versions

Discovery Timeline

2026-06-09 - CVE-2026-6444 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-6444

Vulnerability Analysis

The vulnerability resides in the FlashArray Purity management interface, which exposes administrative operations through role-based access control (RBAC). The interface fails to consistently enforce authorization checks on certain functions. An authenticated account with limited privileges can reach operations intended for higher-privileged roles such as storage administrators. The flaw maps to [CWE-639], where authorization decisions depend on a user-controlled value rather than a server-enforced role check.

Exploitation requires valid credentials and network reachability to the Purity management endpoint. No user interaction beyond the attacker's own session is needed. Because Purity controls the data plane of enterprise storage arrays, abuse can lead to unauthorized changes to volumes, snapshots, replication settings, or access to data otherwise restricted by role.

Root Cause

The root cause is inconsistent server-side authorization enforcement in the Purity management interface. Specific request handlers rely on client-supplied identifiers or insufficient role validation. A low-privileged user can craft requests that reference resources or actions outside their permission scope, and the server processes them rather than rejecting them.

Attack Vector

The attack vector is network-based and requires authenticated access with low privileges. An attacker logs in with any valid low-privileged Purity account and issues crafted API or management requests targeting privileged operations. Pure Storage has not published proof-of-concept details, and no public exploit is available. See the Pure Storage Security Bulletins for vendor-specific exploitation conditions.

Detection Methods for CVE-2026-6444

Indicators of Compromise

Purity audit log entries showing low-privileged accounts invoking administrative endpoints or modifying volumes, hosts, or protection groups
API calls from non-administrative users referencing object identifiers outside their assigned scope
Unexpected configuration changes (snapshot deletion, replication target changes, user role edits) attributed to standard or read-only accounts

Detection Strategies

Enable verbose audit logging on Purity and forward events to a centralized SIEM for correlation with user role metadata
Baseline normal API usage per account role and alert on deviations, particularly low-privileged users invoking admin-only operations
Review authentication and authorization events for users whose action set expands beyond historical patterns

Monitoring Recommendations

Continuously ingest Purity syslog and REST API audit data into a centralized analytics platform
Alert on management-plane access from new source IPs or service accounts not previously seen administering the array
Correlate Purity events with directory service (LDAP/AD) role assignments to detect privilege mismatches

How to Mitigate CVE-2026-6444

Immediate Actions Required

Review the Pure Storage Security Bulletins and identify whether your Purity version is affected
Audit all Purity user accounts and remove unused or excessive low-privileged accounts
Restrict network access to the Purity management interface to a dedicated administrative network or jump hosts
Rotate credentials for low-privileged accounts and enforce multi-factor authentication where supported

Patch Information

Pure Storage distributes fixes for Purity through its support portal. Apply the Purity update referenced in the vendor security bulletin for CVE-2026-6444 as soon as a maintenance window permits. Confirm fixed version numbers directly with Pure Storage support, since affected and fixed versions are tracked in the vendor advisory rather than in NVD.

Workarounds

Limit Purity management interface exposure to an out-of-band management VLAN until patches are applied
Disable or suspend non-essential low-privileged accounts that do not require active access
Increase audit log retention and review frequency to detect unauthorized actions during the exposure window

bash

# Example: restrict access to the Purity management interface at the network edge
# (Adapt to your firewall / ACL syntax)
allow tcp from <admin_jump_host_subnet> to <flasharray_mgmt_ip> port 443
deny  tcp from any to <flasharray_mgmt_ip> port 443