The flaw causes FlashArray Purity to enforce snapshot retention policies earlier or later than the administrator configured, which can delete recovery points prematurely or keep them longer than intended. This leads to loss of critical backup data, unexpected storage usage, and potential non‑compliance with retention policies. The weakness stems from improper enforcement of configured data‑retention controls, classified as CWE‑783.

PureStorage FlashArray products that run Purity//FA releases older than 6.5.13, 6.7.7, 6.9.2, or 6.10.1 are vulnerable. All newer releases at or above these version thresholds are fixed.

The CVSS score of 6.9 indicates moderate severity. No EPSS information is available and the issue is not listed in CISA’s KEV catalog. Exploitation requires privileged access to the management interface, and the problem surfaces under administrative misuse or misconfiguration rather than through an external attack vector.