WaratekVRT Sign in

CVE-2021-20021 SonicWall Email Security

Affected softwareSonicWall Email Security
Severity9.8 Critical CVSS 3.1 3 scores
WeaknessImproper privilege management (CWE-269)
Published9 Apr 2021
Updated12 Aug 2026

Description

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2021-11-03 · remediation due 2021-11-17 · ransomware use: known
  • VulnCheck KEV listed Exploitation reported in the wild. 9 citations · earliest 2021-04-20.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 2 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2023-09-07.
  • EPSS 89% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2021-20021 in VulnCheck (free account), which lists 4 more citations not shown here.

EvidenceSourceDetailDate
Reported exploitation cloud.google.com /blog/topics/threat-intelligence/zero-day-exploits-in-sonicwall-email-security-lead-to-compromise 2021-04-20
Reported exploitation fireeye.com /blog/threat-research/2021/04/zero-day-exploits-in-sonicwall-email-security-lead-to-compromise.html 2021-04-20
Reported exploitation mandiant.com /resources/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day 2021-04-20
Reported exploitation ic3.gov /Media/News/2021/211029.pdf 2021-10-28
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2021-11-03

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC SUPRAAA-1337/CVE-2021-20021 2 2023-09-07
Nuclei SonicWall Email Security <= 10.0.9.x - Unauthenticated Admin Account Creation

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review automated Upstream data
  • Record active
Decided by The only affected product being a sealed appliance image, where Java runs but no -javaagent can be attached
Finding This CVE names only products the Waratek agent cannot be installed into (sonicwall/email_security). They ship as sealed appliance images or as native code with no application JVM, so there is no start-up line to add -javaagent to. The vulnerability may well be a Java one; it is permanently out of ARMR's reach rather than outside its subject.

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Products and versions

11 products, 11 version entries
SourceVendorProductSchemeAffected versions
nvd sonicwall email security generic ＜ 10.0.9.6103
nvd sonicwall email security appliance 3300 firmware generic ＜ 10.0.9.6105
nvd sonicwall email security appliance 4300 firmware generic ＜ 10.0.9.6105
nvd sonicwall email security appliance 5000 firmware generic ＜ 10.0.9.6105
nvd sonicwall email security appliance 5050 firmware generic ＜ 10.0.9.6105
nvd sonicwall email security appliance 7000 firmware generic ＜ 10.0.9.6105
nvd sonicwall email security appliance 7050 firmware generic ＜ 10.0.9.6105
nvd sonicwall email security appliance 8300 firmware generic ＜ 10.0.9.6105
nvd sonicwall email security appliance 9000 firmware generic ＜ 10.0.9.6105
nvd sonicwall email security virtual appliance generic ＜ 10.0.9.6105
nvd sonicwall hosted email security generic ＜ 10.0.9.6103

References

URLTags
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0007 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20021 US Government Resource

Timeline
Published2021-04-09By the CVE Program.
VulnCheck KEV: earliest evidence2021-04-20Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2021-11-03Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: latest evidence2023-08-03Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-08-12NVD's own last-modified date for this record.