PureStorage records

19 published records for vendor purestorage.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

19 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2022-32554No exploit	Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FApurestorage · purity\/\/fa pre-auth RCE	Critical9.8	—	1.3%	Jun 23, 2022
39Monitor	CVE-2024-0001No exploit	A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowingpurestorage · purity\/\/fa · CWE-1188 Pre-auth	Critical9.8	—	0.9%	Sep 23, 2024
39Monitor	CVE-2024-0002No exploit	A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.purestorage · purity\/\/fa · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.5%	Sep 23, 2024
39Monitor	CVE-2024-3057No exploit	A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation.purestorage · flasharray · CWE-269 Pre-auth	Critical9.8	—	0.4%	Oct 8, 2024
37Monitor	CVE-2022-31524No exploit	The PureStorage-OpenConnect/swagger repository through 1.1.5 on GitHub allows absolute path traversal because the Flask send_file function ipurestorage · pure swagger · CWE-22 Pre-auth Path traversal	Critical9.3	—	1.3%	Jul 10, 2022
37Monitor	CVE-2023-4976No exploit	FlashBlade Authentication Mechanism Vulnerabilitypurestorage · flashblade · CWE-269 Pre-auth	Critical9.3	—	0.3%	Jul 17, 2024
35Monitor	CVE-2022-32553No exploit	Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FApurestorage · purity\/\/fa	High8.8	—	1.1%	Jun 23, 2022
35Monitor	CVE-2022-32552No exploit	Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FApurestorage · purity\/\/fa	High8.8	—	1.1%	Jun 23, 2022
35Monitor	CVE-2024-0005No exploit	A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specificpurestorage · purity\/\/fa · CWE-77 RCE Command injection	High8.8	—	0.6%	Sep 23, 2024
35Monitor	CVE-2023-36628No exploit	Privilege Escalation in VASApurestorage · purity\/\/fa · CWE-269	High8.8	—	0.5%	Oct 2, 2023
33Monitor	CVE-2025-9127No exploit	PX Enterprise Improper Sanitization Vulnerabilitypurestorage · portworx · CWE-116	High8.4	—	0.1%	Dec 4, 2025
28Monitor	CVE-2024-0004No exploit	A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege purestorage · purity\/\/fa · CWE-94 RCE	High7.2	—	0.6%	Sep 23, 2024
28Monitor	CVE-2024-0003No exploit	A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the arraypurestorage · purity\/\/fa · CWE-269	High7.2	—	0.4%	Sep 23, 2024
21Monitor	CVE-2017-7352No exploit	Stored Cross-site scripting (XSS) vulnerability in Pure Storage Purity 4.7.5 allows remote authenticated users to inject arbitrary web scrippurestorage · purity · CWE-79 XSS	Medium5.4	—	0.5%	Oct 11, 2017
19Monitor	CVE-2023-32572No exploit	FlashArray pgroup Retention Lock SafeMode Protectionpurestorage · purity\/\/fa · CWE-284 Broken access control (IDOR)	Medium4.9	—	0.4%	Oct 2, 2023
17Monitor	CVE-2023-31042No exploit	FlashBlade Object Store Protocolpurestorage · purity Denial of service	Medium4.3	—	0.5%	Oct 2, 2023
10Monitor	CVE-2023-36627No exploit	FlashBlade Snapshot Schedulerpurestorage · purity Denial of service	Low2.7	—	0.5%	Oct 2, 2023
10Monitor	CVE-2023-28372No exploit	FlashBlade Object Store Privileged Accesspurestorage · purity · CWE-284 Broken access control (IDOR) Denial of service	Low2.7	—	0.5%	Oct 2, 2023
10Monitor	CVE-2023-28373No exploit	FlashArray SafeMode Immutable Vulnerabilitypurestorage · purity\/\/fa Denial of service	Low2.7	—	0.5%	Oct 2, 2023

CVE-2022-32554
39Monitor
Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
purestorage · purity\/\/faJun 23, 2022
CVE-2024-0001
39Monitor
A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
purestorage · purity\/\/faSep 23, 2024
CVE-2024-0002
39Monitor
A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
purestorage · purity\/\/faSep 23, 2024
CVE-2024-3057
39Monitor
A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
purestorage · flasharrayOct 8, 2024
CVE-2022-31524
37Monitor
The PureStorage-OpenConnect/swagger repository through 1.1.5 on GitHub allows absolute path traversal because the Flask send_file function i
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- Path traversal
purestorage · pure swaggerJul 10, 2022
CVE-2023-4976
37Monitor
FlashBlade Authentication Mechanism Vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
purestorage · flashbladeJul 17, 2024
CVE-2022-32553
35Monitor
Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA
HighCVSS 8.8No exploitEPSS 1%
purestorage · purity\/\/faJun 23, 2022
CVE-2022-32552
35Monitor
Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x and prior Purity//FA
HighCVSS 8.8No exploitEPSS 1%
purestorage · purity\/\/faJun 23, 2022
CVE-2024-0005
35Monitor
A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specific
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
purestorage · purity\/\/faSep 23, 2024
CVE-2023-36628
35Monitor
Privilege Escalation in VASA
HighCVSS 8.8No exploitEPSS 0%
purestorage · purity\/\/faOct 2, 2023
CVE-2025-9127
33Monitor
PX Enterprise Improper Sanitization Vulnerability
HighCVSS 8.4No exploitEPSS 0%
purestorage · portworxDec 4, 2025
CVE-2024-0004
28Monitor
A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege
HighCVSS 7.2No exploitEPSS 0%
- RCE
purestorage · purity\/\/faSep 23, 2024
CVE-2024-0003
28Monitor
A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array
HighCVSS 7.2No exploitEPSS 0%
purestorage · purity\/\/faSep 23, 2024
CVE-2017-7352
21Monitor
Stored Cross-site scripting (XSS) vulnerability in Pure Storage Purity 4.7.5 allows remote authenticated users to inject arbitrary web scrip
MediumCVSS 5.4No exploitEPSS 0%
- XSS
purestorage · purityOct 11, 2017
CVE-2023-32572
19Monitor
FlashArray pgroup Retention Lock SafeMode Protection
MediumCVSS 4.9No exploitEPSS 0%
- Broken access control (IDOR)
purestorage · purity\/\/faOct 2, 2023
CVE-2023-31042
17Monitor
FlashBlade Object Store Protocol
MediumCVSS 4.3No exploitEPSS 0%
- Denial of service
purestorage · purityOct 2, 2023
CVE-2023-36627
10Monitor
FlashBlade Snapshot Scheduler
LowCVSS 2.7No exploitEPSS 0%
- Denial of service
purestorage · purityOct 2, 2023
CVE-2023-28372
10Monitor
FlashBlade Object Store Privileged Access
LowCVSS 2.7No exploitEPSS 0%
- Broken access control (IDOR)
- Denial of service
purestorage · purityOct 2, 2023
CVE-2023-28373
10Monitor
FlashArray SafeMode Immutable Vulnerability
LowCVSS 2.7No exploitEPSS 0%
- Denial of service
purestorage · purity\/\/faOct 2, 2023