Pure Storage FlashArray Purity (dormant configuration account): A local account intended only for initial array

Impact

A local account intended only for initial array configuration stays active, letting an attacker gain elevated privileges on the array. Full control of a storage array serving an AI cluster means access to training data and checkpoints, plus the ability to destroy them.

Who can reach it

Network access to the array management interface, using the leftover account.

What to do

Apply the Purity update from Pure's security page. Array software upgrade - non-disruptive on a healthy dual-controller array, but schedule it. Verify the configuration account is actually disabled afterwards rather than trusting the version number.

References