CVE-2021-20021: SonicWall Email Security admin-account creation, actively exploited
The short version: SonicWall Email Security has a flaw (CVE-2021-20021) that lets an unauthenticated attacker create an administrative account by sending one crafted HTTP request. It was exploited as a zero-day — chained with two related bugs by ransomware operators — and it's in CISA's KEV catalog. If you run an affected on-premises appliance, patch it and check whether an account was created. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 83.43% · 99.7th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2021-11-17 |
| Known exploited? | Yes — exploited as a zero-day, chained with CVE-2021-20022/20023; CISA notes known ransomware use |
| Vulnerability type | CWE-269 improper privilege management → unauthenticated administrative account creation |
| Requires authenticated session? | No — pre-authentication |
| Affected | SonicWall Email Security 10.0.9.x (and legacy 7.0.0–9.2.2, now end-of-life) |
| Fixed in | Email Security 10.0.9.6173 or later (Hosted Email Security patched by the vendor) |
What you need to know
CVE-2021-20021 is an access-control failure in SonicWall Email Security. A single crafted request to the appliance creates an administrative account — no authentication needed. From there, an attacker has admin control of the email-security system.
This one has a well-documented, ugly history:
- It was a chained zero-day. Attackers combined it with CVE-2021-20022 (post-auth file upload) and CVE-2021-20023 (post-auth file read) to go from "no access" to code execution, in intrusions attributed to ransomware operators.
- It's an unauthenticated admin takeover. The barrier isn't a weak password — there's no barrier; the request creates the account.
- It's in KEV with ransomware association. CISA lists it and flags known ransomware use, which is exactly why it belongs at the top of the queue.
How serious we see it
High — in practice and on paper.
Unauthenticated administrative account creation on an internet-facing security appliance, confirmed exploited in the wild and chained into ransomware intrusions, is the definition of top-of-queue. The 9.8 is not hyperbole here. The bounded, reassuring part is that it's narrow and fixable: it affects specific Email Security versions, SonicWall's hosted product was patched by the vendor, and on-premises fixes are published. The catch is the same as any pre-patch zero-day — being patched and being clean are separate questions, so verify no rogue admin was created.
Recommendations
Straight from SonicWall's advisory (SNWLID-2021-0007) and CISA:
- Patch now. Upgrade on-premises Email Security to 10.0.9.6173 or later. Legacy 7.0.0–9.2.2 is end-of-life — migrate off it.
- Hunt for rogue accounts. Review the appliance's administrator accounts for any you didn't create, and check logs for the account-creation request and follow-on file activity.
- If you find indicators, respond fully. Rebuild where warranted and rotate credentials and secrets reachable from the appliance.
- Get the management surface off the public internet. Restrict administrative access to trusted networks.
- Confirm your exposure first. Verify whether you run an affected, internet-facing Email Security appliance.
How BreachRisk sees it
BreachRisk discovers internet-facing SonicWall Email Security appliances from little more than your domain, fingerprints the product and version, and flags exposure tied to CVE-2021-20021 — raised to the top because it's in KEV and associated with ransomware. Because verifying this flaw would mean actually creating an administrator account, BreachRisk does not attempt exploitation: it detects and flags the exposed, affected appliance rather than altering it, so the assessment never changes your system's state.
That outside-in, continuous view is the point: when an appliance takeover flaw is being used by ransomware crews, the exposed device is already mapped, so you go straight to patch-and-verify.