CVE-2026-6444: A flaw exists in the FlashArray Purity management interface where an authenticated low-privileged user may, under specific conditions, access functionality beyond their assigned privileges

Synopsis

This is a privilege escalation flaw in the Everpure FlashArray Purity management interface. An authenticated low-privileged user can, under specific conditions, access functionality beyond their assigned role by reaching the vulnerable interface over the network. Successful exploitation gives the attacker read and write access to sensitive data handled by the management plane. HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available as soon as Everpure publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The management interface is exposed over the network, so the attacker must be able to reach it remotely to exploit this flaw.

• AuthenticationRequired

  A valid account is needed to trigger the flaw, but any low-privilege credential is sufficient; no administrative account is required.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker operates entirely on their own.

• Attack complexityDetail

  The exploit is reliable and condition-free once the attacker has network access and a low-privilege credential, with no race conditions or special environmental configuration required.

Blast Radius

• The attacker reads confidential data stored or managed through the FlashArray Purity management interface, including configuration details and potentially stored credentials or access keys.
• The attacker writes to or modifies management-plane data, including storage configuration, access control entries, or volume mappings.
• Confidentiality and integrity of the management interface are both fully compromised, but availability of the service itself is not directly affected by this flaw.
• Lateral movement is a realistic follow-on risk if the management interface controls access to other storage resources or exposes credentials usable elsewhere in the environment.