Pure Storage vulnerabilities

Products

• FlashArray 3
• FlashArray Purity 3
• FlashBlade 2
• FlashBlade Purity 2
• PX Backup 1
• PX Enterprise 1

Latest Pure Storage CVEs

Newest publication first

1. CVE-2025-9127 PX Enterprise Improper Sanitization Vulnerability

   Published 2025-12-04

   High·CVSS 8.4 EPSS 0.14%

   A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions.

2. CVE-2025-2327 FlashArray KEK Logging Vulnerability

   Published 2025-06-16

   Medium·CVSS 5.1 EPSS 0.23%

   A flaw exists in FlashArray whereby the Key Encryption Key (KEK) is logged during key rotation when RDL is configured.

3. CVE-2025-0052 FlashBlade DOS Vulnerability

   Published 2025-06-10

   High·CVSS 8.3 EPSS 0.34%

   Improper input validation performed during the authentication process of FlashBlade could lead to a system Denial of Service.

4. CVE-2025-0051 FlashArray DOS Vulnerability

   Published 2025-06-10

   High·CVSS 8.7 EPSS 0.39%

   Improper input validation performed during the authentication process of FlashArray could lead to a system Denial of Service.

5. CVE-2025-1308 PX Backup Improper Sanitization Vulnerability

   Published 2025-05-19

   High·CVSS 8.4 EPSS 0.16%

   A vulnerability exists in PX Backup whereby sensitive information may be logged under specific conditions.

6. CVE-2024-0001 A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor to gain elevated privileges.

   Published 2024-09-23

   Critical·CVSS 9.8 EPSS 0.95%

   A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor to gain elevated privileges.

7. CVE-2023-36628 Privilege Escalation in VASA

   Published 2023-10-02

   High·CVSS 8.8 EPSS 0.56%

   A flaw exists in VASA which allows users with access to a vSphere/ESXi VMware admin on a FlashArray to gain root access through privilege escalation.

8. CVE-2023-32572 FlashArray pgroup Retention Lock SafeMode Protection

   Published 2023-10-02

   Medium·CVSS 4.9 EPSS 0.48%

   A flaw exists in FlashArray Purity wherein under limited circumstances, an array administrator can alter the retention lock of a pgroup and disable pgroup SafeMode protection.

9. CVE-2023-28373 FlashArray SafeMode Immutable Vulnerability

   Published 2023-10-02

   Low·CVSS 2.7 EPSS 0.52%

   A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data on the system including snapshots protected by SafeMode.

10. CVE-2023-36627 FlashBlade Snapshot Scheduler

    Published 2023-10-02

    Low·CVSS 2.7 EPSS 0.59%

    A flaw exists in FlashBlade Purity whereby a user with access to an administrative account on a FlashBlade that is configured with timezone-dependent snapshot schedules can configure a timezone to prevent the schedule from functioning properly.

11. CVE-2023-31042 FlashBlade Object Store Protocol

    Published 2023-10-02

    Medium·CVSS 4.3 EPSS 0.60%

    A flaw exists in FlashBlade Purity whereby an authenticated user with access to FlashBlade’s object store protocol can impact the availability of the system’s data access and replication protocols.

12. CVE-2023-28372 FlashBlade Object Store Privileged Access

    Published 2023-10-02

    Low·CVSS 2.7 EPSS 0.55%

    A flaw exists in FlashBlade Purity (OE) Version 4.1.0 whereby a user with privileges to extend an object’s retention period can affect the availability of the object lock.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.