CVE-2026-0209

OVERVIEW CVE-2026-0209 affects Pure Storage's FlashArray Purity software, where snapshot retention policies may be applied at incorrect times due to certain administrative conditions. This timing discrepancy could cause snapshots to be retained longer or deleted sooner than configured, potentially impacting backup and disaster recovery operations. SEVERITY The vulnerability carries a moderate FAUCET Risk Score of 36.0/100, though a CVSS score has not been assigned. The attack vector and complexity details are not publicly available, suggesting this issue may require specific administrative access or particular operational configurations to manifest. The primary impact would be operational disruption to backup retention schedules rather than direct data compromise or unauthorized access. EXPLOITATION STATUS There is no evidence of active exploitation. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains classified as inactive on threat tracking lists. The EPSS score of 0.00016 indicates exceptionally low probability of exploitation in the wild, with minimal community attention or available exploit code at this time.