Pure Storage

12 CVEs across 6 Pure Storage products. Browse Pure Storage vulnerabilities, severities, and proof-of-concept exploits.

Pure Storage products with known CVEs

ProductCVEs
Flasharray3
Flasharray Purity3
Flashblade2
Flashblade Purity2
Px Backup1
Px Enterprise1
Pure Storage CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-9127Medium5.52025-12-04A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions.
CVE-2025-23272025-06-16A flaw exists in FlashArray whereby the Key Encryption Key (KEK) is logged during key rotation when RDL is configured.
CVE-2025-00522025-06-10Improper input validation performed during the authentication process of FlashBlade could lead to a system Denial of Service.
CVE-2025-00512025-06-10Improper input validation performed during the authentication process of FlashArray could lead to a system Denial of Service.
CVE-2025-13082025-05-19A vulnerability exists in PX Backup whereby sensitive information may be logged under specific conditions.
CVE-2024-0001Critical10.02024-09-23A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor…
CVE-2023-36628High8.82023-10-03A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.
CVE-2023-32572Medium6.52023-10-03A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup Safe…
CVE-2023-28373Medium4.42023-10-03A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system incl…
CVE-2023-36627High7.72023-10-02A flaw exists in FlashBlade Purity whereby a user with access to an administrative account on a FlashBlade that is configured with timezone-dependent snapshot…
CVE-2023-31042High7.72023-10-02A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s…
CVE-2023-28372Medium6.52023-10-02A flaw exists in FlashBlade Purity (OE) Version 4.1.0 whereby a user with privileges to extend an object’s retention period can affect the availability of the…