CVE-2021-20021

What it actually does

CVE-2021-20021 is an unauthenticated privilege-escalation flaw in SonicWall Email Security 10.0.9.x and SonicWall Hosted Email Security that allows a remote attacker to send a crafted HTTP request to the appliance and create a new administrative account. Because exploitation requires no credentials, no user interaction, and network access to the web interface, successful exploitation can give the attacker full administrative control of the email security platform, including access to configuration, mail-handling policy, quarantine data, and potentially additional attack surface for chaining with file upload, file read, or code execution weaknesses.

Why it matters to the business

An attacker who gains administrator access to an email security gateway can interfere with inbound and outbound mail flow, weaken filtering controls, inspect sensitive email content, create persistence, and use the platform as a stepping stone into broader operations. This vulnerability is listed in CISA KEV, has a high EPSS likelihood score, is known to have been exploited in the wild, and is associated with ransomware activity, so exposed or unpatched systems should be treated as high-priority incident-response candidates rather than routine patching items.

How an attack unfolds

An attacker first identifies an internet-facing SonicWall Email Security or Hosted Email Security web interface running an affected 10.0.9.x build. The attacker then sends a specially crafted HTTP request to the vulnerable administrative functionality that improperly allows account creation without a valid administrative session. If the request succeeds, the attacker obtains a newly created administrator account and logs in through the normal web interface. From there, the attacker can modify mail security policy, create additional users, disable or bypass controls, access sensitive configuration and message data, and potentially chain the access with other SonicWall Email Security vulnerabilities to upload tools, read files, deploy web shells, or support ransomware intrusion activity.

How to fix it

Upgrade SonicWall Email Security and SonicWall Hosted Email Security to a vendor-supported fixed release or apply the relevant SonicWall hotfix for affected 10.0.9.x deployments. Because no exact fixed version was provided in the input, use the latest SonicWall advisory and current supported release as the source of truth. Hosted deployments should be verified with SonicWall support or the management portal to confirm the service-side fix is applied. Restrict administrative web access to trusted management networks or VPNs, block direct internet exposure where possible, remove any unknown administrator accounts, rotate administrative credentials, review mail-routing and filtering configuration for unauthorized changes, and treat any appliance with evidence of unauthorized admin creation as potentially compromised.

How to confirm the fix worked

Confirm the installed SonicWall Email Security version is no longer an affected 10.0.9.x build and that the applicable vendor hotfix or later supported release is installed. Verify that the administrative interface is not reachable from untrusted networks unless explicitly required and protected by compensating controls. Review the administrator user list and audit logs for unexpected accounts created before remediation. Where safe and authorized, perform a controlled validation test or vulnerability scan that confirms unauthenticated administrative account creation is no longer possible. Recheck after upgrades that mail policies, routing settings, quarantine access, administrator roles, and authentication settings match the approved baseline.

Typical attack path

1. Scan for exposed SonicWall Email Security web interfaces.
2. Fingerprint the product and version or infer vulnerability from exposed behavior.
3. Send a crafted unauthenticated HTTP request that abuses the account-creation flaw.
4. Create a new administrative account on the appliance or hosted instance.
5. Authenticate to the web administration portal using the attacker-created account.
6. Modify configuration, mail-routing rules, filtering policies, or administrator settings to support persistence or evasion.
7. Optionally chain with additional vulnerabilities or post-authentication features to access files, deploy tooling, or expand into the environment.
8. Use the compromised email security platform to monitor mail, steal information, disrupt mail flow, or support broader intrusion and ransomware operations.

How to detect it

Review SonicWall Email Security application audit logs, administrator activity logs, web access logs, reverse proxy/WAF logs, VPN logs, identity logs, and operating system or Tomcat logs if available. Focus on evidence of administrator accounts created without a corresponding approved change, especially accounts created from unfamiliar source IP addresses or immediately followed by successful logins. Look for unauthenticated HTTP POST requests to administrative account-management or user-management functionality, successful administrative logins from new geographies or hosting-provider IP space, and configuration changes shortly after account creation. Also review for downstream activity that may indicate chaining or persistence, such as new mail-forwarding behavior, disabled filters, altered quarantine settings, unexpected file uploads, web shell artifacts, unusual child processes spawned by the web application, and outbound connections from the appliance to unfamiliar hosts. Because this issue has been exploited in the wild and is associated with ransomware activity, detection should cover historical logs around the original disclosure period and any later periods when affected 10.0.9.x systems were internet-exposed. If logs are incomplete or rotated, compare current administrator accounts and configuration against known-good backups or change records.

What your security team should do

• Immediately identify all SonicWall Email Security and Hosted Email Security assets, especially internet-facing administrative interfaces.
• Prioritize remediation as urgent because the vulnerability is in CISA KEV, has known in-the-wild exploitation, has a high EPSS score, and is associated with ransomware activity.
• Upgrade or hotfix affected 10.0.9.x systems using SonicWall-supported fixed releases, then verify the version and patch state.
• Restrict management access to trusted networks, VPN, or allowlisted administrative IP ranges; remove direct public exposure where possible.
• Audit administrator accounts for unknown, recently created, disabled-looking, or suspiciously named accounts and remove any unauthorized entries.
• Rotate passwords and credentials for all SonicWall Email Security administrators after patching and account cleanup.
• Review mail policies, transport rules, quarantine settings, forwarding rules, and filtering exclusions for unauthorized changes.
• Search historical logs for suspicious unauthenticated HTTP requests, unexpected admin creation events, and logins from unusual IP addresses around and before the remediation date.
• If unauthorized administrator creation is found, escalate to incident response, preserve logs and disk images where feasible, and investigate for chained exploitation, web shells, credential theft, and lateral movement.
• Monitor for renewed exploitation attempts against the administrative interface even after remediation, as vulnerable systems have been widely targeted for years.