SonicWall · SonicWall Email Security

CVE-2021-20021

SonicWall Email Security Improper Privilege Management Vulnerability

Exploited in attacks Used by ransomware Critical 9.8 Attack chance: 89%

What it is

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.

CISA: SonicWall Email Security contains an improper privilege management vulnerability that allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. This vulnerability has known usage in a SonicWall Email Security exploit chain along with CVE-2021-20022 and CVE-2021-20023 to achieve privilege escalation.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: November 17, 2021

Added to the CISA list: November 3, 2021
Published: April 9, 2021
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 89% in the top 0.2% of all known vulnerabilities
Weakness: CWE-306
More details: NVD · CVE.org · CISA

All references (1)

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0007

More exploited flaws from SonicWall

Added	Vulnerability	Product	Severity	Attack chance
Nov 3, 2021	Email Security Unrestricted Upload of FileCVE-2021-20022used by ransomware	SonicWall Email Security	High 7.2	17%
Nov 3, 2021	Email Security Path TraversalCVE-2021-20023used by ransomware	SonicWall Email Security	Medium 4.9	52%
Sep 2, 2026	Server-Side Request ForgeryCVE-2026-83548	SMA1000 Appliances	Critical 10.0	8.0%
Sep 2, 2026	OS Command InjectionCVE-2026-83549	SMA1000 Appliances	High 7.8	9.9%
Jul 14, 2026	Server-Side Request ForgeryCVE-2026-15409used by ransomware	SMA1000 Appliances	Critical 10.0	6.8%
Jul 14, 2026	Code InjectionCVE-2026-15410used by ransomware	SMA1000 Appliances	High 7.2	12%
Dec 17, 2025	SMA1000 Missing AuthorizationCVE-2025-40602	SMA1000 appliance	Medium 6.6	2.8%
May 1, 2025	OS Command InjectionCVE-2023-44221	SMA100 Appliances	High 7.2	76%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.