FlashBlade can inadvertently record confidential data in log files when particular conditions are met. The vulnerability permits an attacker who can access those logs to read sensitive information, compromising confidentiality. It results from improper handling of data before logging, matching CWE‑532.

PureStorage FlashBlade environments that use Purity//FB releases earlier than 4.5.14 or 4.6.4 are affected. All previous FlashBlade firmware versions are susceptible to sensitive data logging until the vendor provides the patch.

The CVSS score of 8.5 indicates high overall risk. Because the CVE lacks an EPSS score and is not listed in the CISA KEV catalog, the probability of public exploitation is currently unknown, but the impact of exposure remains significant. Attackers would need the ability to read log files, which may be possible through local or privileged access; the exact attack vector is not detailed in the description and is thus inferred based on the vulnerability type.