Certain data paths in FlashArray Purity are not properly filtered, allowing an authenticated user with low privileges to access sensitive information. The flaw leads to an information‑disclosure vulnerability identified as CWE‑939, where data that should not be exposed becomes available through unfiltered paths. The consequence is that confidentiality of system data is compromised for users who would normally have limited access.

The vulnerability affects Everpure FlashArray, but specific product versions are not disclosed in the available data. Users of any FlashArray deployment that includes the impacted component should verify their version against vendor advisories.

The CVSS score of 8.7 indicates a high‑severity issue, and while the EPSS score is not available, the lack of listing in CISA KEV suggests no publicly reported exploitation to date. The likely attack vector is local or network‑based authentication that reaches the data paths in question; once logged in with low privileges, an attacker can read sensitive data. There are no additional prerequisites such as elevated privileges or special configuration, making this vulnerability readily exploitable for any authenticated user within reach of the system.