CVE-2026-0209

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0209", "assignerOrgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "state": "PUBLISHED", "assignerShortName": "PureStorage", "dateReserved": "2025-10-30T16:39:22.241Z", "datePublished": "2026-04-14T17:52:54.759Z", "dateUpdated": "2026-04-14T21:56:10.258Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "shortName": "PureStorage", "dateUpdated": "2026-04-14T21:56:10.258Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-783", "description": "CWE-783 Operator precedence logic error", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-176", "descriptions": [{"lang": "en", "value": "CAPEC-176 Configuration/Environment Manipulation"}]}], "affected": [{"vendor": "PureStorage", "product": "FlashArray", "versions": [{"status": "affected", "version": "5.0.0", "lessThanOrEqual": "5.3.21", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThanOrEqual": "6.4.10", "versionType": "custom"}, {"status": "affected", "version": "6.5.0", "lessThanOrEqual": "6.5.12", "versionType": "custom"}, {"status": "affected", "version": "6.6.0", "lessThanOrEqual": "6.6.11", "versionType": "custom"}, {"status": "affected", "version": "6.7.0", "lessThanOrEqual": "6.7.6", "versionType": "custom"}, {"status": "affected", "version": "6.8.0", "lessThanOrEqual": "6.8.9", "versionType": "custom"}, {"status": "affected", "version": "6.9.0", "lessThanOrEqual": "6.9.1", "versionType": "custom"}, {"status": "affected", "version": "6.10.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:purestorage:flasharray:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0.0", "versionEndIncluding": "5.3.21"}, {"vulnerable": true, "criteria": "cpe:2.3:a:purestorage:flasharray:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndIncluding": "6.4.10"}, {"vulnerable": true, "criteria": "cpe:2.3:a:purestorage:flasharray:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5.0", "versionEndIncluding": "6.5.12"}, {"vulnerable": true, "criteria": "cpe:2.3:a:purestorage:flasharray:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.0", "versionEndIncluding": "6.6.11"}, {"vulnerable": true, "criteria": "cpe:2.3:a:purestorage:flasharray:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7.0", "versionEndIncluding": "6.7.6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:purestorage:flasharray:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8.0", "versionEndIncluding": "6.8.9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:purestorage:flasharray:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9.0", "versionEndIncluding": "6.9.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:purestorage:flasharray:6.10.0:*:*:*:*:*:*:*"}]}]}], "descriptions": [{"lang": "en", "value": "Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured."}]}], "references": [{"url": "https://support.purestorage.com/bundle/m_security_bulletins/page/Pure_Security/topics/concept/c_security_bulletins.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}}], "solutions": [{"lang": "en", "value": "This issue is resolved in the following FlashArray //Purity versions: * Purity//FA 6.5.13 or later\n\n\n * Purity//FA 6.7.7 or later\n\n\n * Purity//FA 6.9.2 or later\n\n\n * Purity//FA 6.10.1 or later", "supportingMedia": [{"type": "text/html", "base64": false, "value": "This issue is resolved in the following FlashArray //Purity versions:<ul><li><p>Purity//FA 6.5.13 or later</p></li><li><p>Purity//FA 6.7.7 or later</p></li><li><p>Purity//FA 6.9.2 or later</p></li><li><p>Purity//FA 6.10.1 or later</p></li></ul>"}]}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T18:55:10.491319Z", "id": "CVE-2026-0209", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T18:55:27.703Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0209", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T18:55:10.491319Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T18:55:23.161Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-176", "descriptions": [{"lang": "en", "value": "CAPEC-176 Configuration/Environment Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PureStorage", "product": "FlashArray", "versions": [{"status": "affected", "version": "5.0.0", "versionType": "custom", "lessThanOrEqual": "5.3.21"}, {"status": "affected", "version": "6.0.0", "versionType": "custom", "lessThanOrEqual": "6.4.10"}, {"status": "affected", "version": "6.5.0", "versionType": "custom", "lessThanOrEqual": "6.5.12"}, {"status": "affected", "version": "6.6.0", "versionType": "custom", "lessThanOrEqual": "6.6.11"}, {"status": "affected", "version": "6.7.0", "versionType": "custom", "lessThanOrEqual": "6.7.6"}, {"status": "affected", "version": "6.8.0", "versionType": "custom", "lessThanOrEqual": "6.8.9"}, {"status": "affected", "version": "6.9.0", "versionType": "custom", "lessThanOrEqual": "6.9.1"}, {"status": "affected", "version": "6.10.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "This issue is resolved in the following FlashArray //Purity versions: * Purity//FA 6.5.13 or later\n\n\n * Purity//FA 6.7.7 or later\n\n\n * Purity//FA 6.9.2 or later\n\n\n * Purity//FA 6.10.1 or later", "supportingMedia": [{"type": "text/html", "value": "This issue is resolved in the following FlashArray //Purity versions:<ul><li><p>Purity//FA 6.5.13 or later</p></li><li><p>Purity//FA 6.7.7 or later</p></li><li><p>Purity//FA 6.9.2 or later</p></li><li><p>Purity//FA 6.10.1 or later</p></li></ul>", "base64": false}]}], "references": [{"url": "https://support.purestorage.com/bundle/m_security_bulletins/page/Pure_Security/topics/concept/c_security_bulletins.html"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured.", "supportingMedia": [{"type": "text/html", "value": "Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-783", "description": "CWE-783 Operator precedence logic error"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:purestorage:flasharray:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "5.3.21", "versionStartIncluding": "5.0.0"}, {"criteria": "cpe:2.3:a:purestorage:flasharray:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "6.4.10", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:purestorage:flasharray:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "6.5.12", "versionStartIncluding": "6.5.0"}, {"criteria": "cpe:2.3:a:purestorage:flasharray:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "6.6.11", "versionStartIncluding": "6.6.0"}, {"criteria": "cpe:2.3:a:purestorage:flasharray:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "6.7.6", "versionStartIncluding": "6.7.0"}, {"criteria": "cpe:2.3:a:purestorage:flasharray:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "6.8.9", "versionStartIncluding": "6.8.0"}, {"criteria": "cpe:2.3:a:purestorage:flasharray:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "6.9.1", "versionStartIncluding": "6.9.0"}, {"criteria": "cpe:2.3:a:purestorage:flasharray:6.10.0:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "shortName": "PureStorage", "dateUpdated": "2026-04-14T21:56:10.258Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0209", "state": "PUBLISHED", "dateUpdated": "2026-04-14T21:56:10.258Z", "dateReserved": "2025-10-30T16:39:22.241Z", "assignerOrgId": "3895c224-4e1d-482a-adb3-fa64795683ac", "datePublished": "2026-04-14T17:52:54.759Z", "assignerShortName": "PureStorage"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FlashArray", "vendor": "PureStorage", "versions": [{"lessThanOrEqual": "5.3.21", "status": "affected", "version": "5.0.0", "versionType": "custom"}, {"lessThanOrEqual": "6.4.10", "status": "affected", "version": "6.0.0", "versionType": "custom"}, {"lessThanOrEqual": "6.5.12", "status": "affected", "version": "6.5.0", "versionType": "custom"}, {"lessThanOrEqual": "6.6.11", "status": "affected", "version": "6.6.0", "versionType": "custom"}, {"lessThanOrEqual": "6.7.6", "status": "affected", "version": "6.7.0", "versionType": "custom"}, {"lessThanOrEqual": "6.8.9", "status": "affected", "version": "6.8.0", "versionType": "custom"}, {"lessThanOrEqual": "6.9.1", "status": "affected", "version": "6.9.0", "versionType": "custom"}, {"status": "affected", "version": "6.10.0", "versionType": "custom"}]}], "source": "psirt@purestorage.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured."}, {"lang": "es", "value": "Bajo ciertas condiciones administrativas, FlashArray Purity puede aplicar pol\u00edticas de retenci\u00f3n de instant\u00e1neas antes o despu\u00e9s de lo configurado."}], "id": "CVE-2026-0209", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@purestorage.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0209", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T18:55:10.491319Z", "version": "2.0.3"}}]}, "published": "2026-04-14T18:16:41.980", "references": [{"source": "psirt@purestorage.com", "url": "https://support.purestorage.com/bundle/m_security_bulletins/page/Pure_Security/topics/concept/c_security_bulletins.html"}], "sourceIdentifier": "psirt@purestorage.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-783"}], "source": "psirt@purestorage.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.3.21]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0,6.4.10]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.5.0,6.5.12]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.0,6.6.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.7.0,6.7.6]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.8.0,6.8.9]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.9.0,6.9.1]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.10.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FlashArray", "source": "cna", "vendor": "PureStorage"}, "product": "flasharray", "vendor": "purestorage"}], "analysis": {"en": {"generated_at": "2026-04-14T21:33:57.375789+00:00", "value": {"mitigation_remediation": ["Upgrade Purity//FA to 6.5.13 or later, or to 6.7.7 or later, or to 6.9.2 or later, or to 6.10.1 or later"], "summary": {"action": "Apply Patch", "impact": "Data loss due to misapplied snapshot retention"}, "threat_synthesis": {"affected_systems": "PureStorage FlashArray products that run Purity//FA releases older than 6.5.13, 6.7.7, 6.9.2, or 6.10.1 are vulnerable. All newer releases at or above these version thresholds are fixed.", "description_and_impact": "The flaw causes FlashArray Purity to enforce snapshot retention policies earlier or later than the administrator configured, which can delete recovery points prematurely or keep them longer than intended. This leads to loss of critical backup data, unexpected storage usage, and potential non\u2011compliance with retention policies. The weakness stems from improper enforcement of configured data\u2011retention controls, classified as CWE\u2011783.", "risk_and_exploitability": "The CVSS score of 6.9 indicates moderate severity. No EPSS information is available and the issue is not listed in CISA\u2019s KEV catalog. Exploitation requires privileged access to the management interface, and the problem surfaces under administrative misuse or misconfiguration rather than through an external attack vector."}}}}, "created": "2026-04-15T14:31:56.908188+00:00", "title": "Incorrect Snapshot Retention Timing in Pure Storage FlashArray May Lead to Data Loss", "updated": "2026-04-15T14:41:09.777651+00:00", "vendors": ["purestorage", "purestorage$PRODUCT$flasharray"]}