Skip to main content
IMMUNITYSEC

CVE-2021-20021

9.8
CRITICAL
CVSS 3.1
EPSS 88.7% · 100th pctCISA KEV · Exploited in the wildCWE-269
2021-04-09•Updated 2026-08-12•KEV 2021-11-03
CISA Known Exploited Vulnerabilities

SonicWall Email Security Improper Privilege Management Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV
2021-11-03
Remediation due
2021-11-17
Ransomware
Known use

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2021-20021

Description

A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.

Severity

CVSS 3.1 · CISA9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC · CISA-ADP
Exploitationactive
Automatableyes
Technical impacttotal

Affected Products

VendorProductAffected versions
SonicWallEmail Security
10.0.9 and earlier

References

1 Links

Record Details

Published
2021-04-09
Last updated
2026-08-12
Assigner (CNA)
sonicwall
Credited to
-

More from SonicWall

CVE-2021-200389.8

SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability

CVE-2019-74817.5

SonicWall SMA100 SQL Injection Vulnerability

CVE-2024-537048.2

SonicWall SonicOS SSLVPN Improper Authentication Vulnerability

CVE-2023-442217.2

SonicWall SMA100 Appliances OS Command Injection Vulnerability

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-269 · Improper Privilege Management
IAM ToolsApplication Security Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.