CVE-2021-20021criticalunder attackransomwareCWE-269

CVE-2021-20021: critical vulnerability in SonicWall Email Security

Published · Updated

Follow this CVE+ Monitor Email Security

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 89%
from disclosure to weapon881 days
Published on NVDApr 9
1st PoC+881d
CISA KEV+208d
Action required by CISAfederal deadline: 2021-11-17

Apply updates per vendor instructions.

In short

A flaw in SonicWall Email Security lets attackers create admin accounts by sending specially crafted requests to the server. This is critical because an attacker gains full control of the email security system without needing existing credentials.

Technical detail

An improper access control vulnerability (CWE-269) in SonicWall Email Security 10.0.9.x permits unauthenticated attackers to create administrative accounts via crafted HTTP requests. No authentication or special preconditions are required, resulting in complete compromise of the email security gateway.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
SonicWall · Email Security
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SonicWall Email Security

In the same product, most dangerous first.

CVE-2021-20023MEDIUMCVE-2021-20023EPSS 51.7%KEVCVE-2021-20022HIGHCVE-2021-20022EPSS 16.6%KEVCVE-2024-22398MEDIUMCVE-2024-22398EPSS 0.9%CVE-2026-3469LOWCVE-2026-3469EPSS 0.4%CVE-2025-40605MEDIUMCVE-2025-40605EPSS 0.4%CVE-2026-3470LOWCVE-2026-3470EPSS 0.3%