What’s Vulnerable › Vulnerabilities

CVE-2025-2327: FlashArray KEK Logging Vulnerability

• Severity: medium (CVSS 5.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-16 · updated 2026-06-17
• Weakness: CWE-532

Description

A flaw exists in FlashArray whereby the Key Encryption Key (KEK) is logged during key rotation when RDL is configured.

Affected products

• PureStorage FlashArray: from 6.0.0 through 6.0.9; from 6.1.0 through 6.1.25; from 6.2.0 through 6.2.17; from 6.3.0 through 6.3.21; from 6.4.0 through 6.4.10; from 6.5.0 through 6.5.10

References

• https://support.purestorage.com/category/m_pure_storage_product_security

Get alerted when CVE-2025-2327 or the next vulnerability affects your stack