Actively exploited in the wild
SonicWall Email Security Improper Privilege Management Vulnerability
SonicWall - SonicWall Email Security · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-20021
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
Risk Assessment
An attacker can gain unauthorized administrative access to the email security system, potentially leading to compromise of message confidentiality and integrity, and system takeover.
Recommendation
Update SonicWall Email Security to the latest available version that includes the fix.
Other vulnerabilities in SonicWall Email Security
See all- CVE-2025-40604Critical
The SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore access to modify system files and gain persistent arbitrary code execution.
- CVE-2021-20023MediumActively exploited
SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
- CVE-2021-20022HighActively exploited
Vulnerability in SonicWall Email Security version 10.0.9.x allows a post-authenticated attacker to upload an arbitrary file to the remote host.
- CVE-2026-66150High
Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP.
- CVE-2026-66149High
Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask.
- CVE-2026-3470Low
The SonicWall Email Security appliance has a vulnerability due to improper input sanitization that may lead to data corruption. A remote authenticated attacker with admin privileges can exploit this by providing crafted input that corrupts the application database.
- CVE-2026-3469Low
SonicWall Email Security has a DoS vulnerability due to improper input validation, exploitable by a remote authenticated admin user.
- CVE-2026-3468Medium
A stored XSS vulnerability exists in SonicWall Email Security due to improper input neutralization. A remote authenticated admin user can execute arbitrary JavaScript code.
Original NVD description (English source)
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS