First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-6444

HighCVSS 8.6/10Last modified Jul 23, 2026

Description

A flaw exists in the FlashArray Purity management interface where an authenticated low-privileged user may, under specific conditions, access functionality beyond their assigned privileges.

Metrics

CVSS 4.0 8.6/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Everpure	FlashArray	>= 6.10.0, <= 6.10.5

References

https://support.purestorage.com/bundle/m_security_bulletins/page/Pure_Security/topics/concept/c_security_bulletins.html

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-644408.1In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HT_caps_handler() HT_caps_handler CVE-2026-644418.8In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(CVE-2026-644428.1In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and j CVE-2026-644438.1In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop The I CVE-2026-644448.1In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop The IE parsin CVE-2026-644458.8In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() CVE-2026-644467.8In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie CVE-2026-644477.8In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths CVE-2026-644488.2In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc[0] exemption to responses without dat CVE-2026-644497.8In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLA CVE-2026-64458.7A flaw exists in FlashArray Purity where insufficient filtering of certain data paths could expose sensitive information to an authenticated CVE-2026-644509.1In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast P

CVE-2026-6444: High severity, CVSS 8.6 | Vulnix