CVE-2026-6445: A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated user with low privileges

Synopsis

An information disclosure and privilege-escalation flaw exists in Everpure FlashArray Purity, affecting versions up to 6.5.8 and 6.10.5. The vulnerability is reachable over the network by any authenticated user holding only low-privilege credentials, with no victim interaction required. Successful exploitation gives the attacker read access to sensitive data as well as the ability to tamper with and disrupt the affected storage system. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the FlashArray Purity service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is required.

• AuthenticationRequired

  A valid account is needed to exploit this flaw, but any low-privilege account is sufficient; no administrative credentials are required (PR:L).

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the vulnerable code path entirely on their own (UI:N).

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and imposes no special preconditions such as race conditions or specific memory layout requirements.

Blast Radius

• Reads sensitive data accessible through the affected Purity data paths, including configuration details and potentially stored credentials or access tokens (VC:H).
• Modifies persisted storage configuration or data on the FlashArray system (VI:H).
• Crashes or disrupts the availability of the affected FlashArray Purity service (VA:H).
• Impact is confined to the vulnerable system; the CVSS vector records no subsequent or lateral impact on other systems in scope (SC:N, SI:N, SA:N).