A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate…

Description

A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.

Scores

EPSS (exploitation in 30 days)

0.64% · top 49% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.1.

Weakness

• CWE-94 Improper Control of Generation of Code ('Code Injection') (opens in a new tab)All about CWE-94 and its CVEs

Affected products

• PureStorage · FlashArray

  • affected 5.0.0 – ≤ 5.0.11
  • affected 5.1.0 – ≤ 5.1.17
  • affected 5.2.0 – ≤ 5.2.7
  • affected 5.3.0 – ≤ 5.3.21
  • affected 6.0.0 – ≤ 6.0.9
  • affected 6.1.0 – ≤ 6.1.25
  • affected 6.2.0 – ≤ 6.2.17
  • affected 6.3.0 – ≤ 6.3.14
  • affected 6.4.0 – ≤ 6.4.10
  • affected 6.5.0

What to do

Solution: Affected customers will need to apply a self-service patch bundle or upgrade their Purity to an unaffected Purity version. This issue is resolved in the following FlashArray Purity releases: * Purity//FA versions 6.3.15 or later * Purity//FA versions 6.5.1 or later * Purity//FA versions 6.6.1 or later.

References (1)

• https://purestorage.com/security (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2024-0004](https://trackcve.app/badge/CVE-2024-0004.svg)](https://trackcve.app/cve/CVE-2024-0004)

Record last updated 24 Sept 2024, 13:37 UTC.