CVE-2021-20023

Exploited in the wild. In CISA KEV since 2021‑11‑03. A vendor fix is available.

CVSS 3.14.9Medium EPSS percentile99th51% chance in 30 days CISA KEVListedsince 2021-11-03, due 2021-11-17
No public exploit known FixVendor fixNo build named by the sources

Published 2021-04-20Updated 2026-08-12Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your deployment type (Email Security, Hosted Email Security, Email Security Appliance firmware, or Email Security Virtual Appliance) and identify your exact version (10.0.9.x and whether you have any .xxxx build listed).
If you are on SonicWall Email Security 10.0.9.x, plan an immediate upgrade to the fixed build for your product.
Upgrade to the fixed version(s): Email Security → 10.0.9.6173; Email Security Appliance (9000/3300/4300/8300/5000/7000/5050/7050) and Email Security Virtual Appliance → 10.0.9.6177; Hosted Email Security → 10.0.9.6173.
After upgrading, confirm the system now reports the expected fixed version and that the email security services are healthy, then review authentication logs for suspicious authenticated activity around the time of any attempted access.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.

In plain language

Written by AI from the record

CVE-2021-20023 is a SonicWall Email Security flaw where a logged-in attacker can read any file on the system, and since it was used in real ransomware activity, RED means small businesses should act now by updating to the fixed versions.

CVE-2021-20023 is a post-authenticated arbitrary file read in SonicWall Email Security (and related appliances/hosted services) caused by improper input validation, enabling an attacker with valid credentials to read arbitrary server files; it is listed in the CISA KEV and was used in ransomware campaigns.

If you're affected

Sensitive data theft from server
Possible takeover of sensitive systems
Ransomware enablement via stolen data
Operational disruption

What is it

This vulnerability lets someone who already has a valid login use the product to view files on the server that should not be readable. Think of it like a “locked office” where a person with a badge can open any drawer and look inside—so if an attacker gets credentials, they can steal sensitive information. Even though this specific flaw is about reading files (not changing them), that stolen information can help attackers run ransomware and stay hidden.

Who is affected

This matters if your business uses SonicWall Email Security, Hosted Email Security, or one of the listed SonicWall Email Security Appliance firmware lines (including Email Security Virtual Appliance). Because the issue needs a valid authenticated session, it is most relevant when attackers can obtain credentials (for example, via phishing, stolen passwords, or reused logins). It is a risk only when the affected product is reachable to attackers and there is a valid path for authentication attempts (and attackers already have credentials).

How urgent is it

This is RED because the flaw is confirmed in the CISA KEV and was used in ransomware campaigns—meaning real attackers have already used it in the wild. Your fastest path to reducing risk is to upgrade to the fixed versions listed for your exact SonicWall deployment.

What to do — in detail

Confirm whether you’re affected

Identify which SonicWall product you run from the affected list: Email Security, Hosted Email Security, Email Security Appliance (9000/3300/4300/8300/5000/7000/5050/7050 firmware), or Email Security Virtual Appliance.
Check the exact software/firmware version you are currently running. The vulnerability is in SonicWall Email Security 10.0.9.x.

Upgrade to the fixed build (required remediation)

If you run Email Security: upgrade to 10.0.9.6173.
If you run Hosted Email Security: upgrade to 10.0.9.6173.
If you run any listed Email Security Appliance firmware (9000/3300/4300/8300/5000/7000/5050/7050): upgrade to 10.0.9.6177.
If you run Email Security Virtual Appliance: upgrade to 10.0.9.6177.

Validate after patching

Verify the product now reports the fixed version (10.0.9.6173 or 10.0.9.6177 depending on your deployment).
Confirm email security services are operating normally.

If you cannot patch immediately

Reduce the chance that attackers can authenticate: restrict admin/user access paths as much as your operations allow, and review firewall/proxy rules so only necessary clients can reach the authentication interfaces.
Audit for signs of credential compromise: check authentication logs for unusual logins, successful logins from unfamiliar sources, and any repeated attempts that coincide with changes in file-access behavior.

CISA deadline guidance

The CISA KEV due date for remediation was 2021-11-17; treat your upgrade as urgent to close exposure.

What to monitor next

Logins to the email security admin/auth endpoints and any anomalous successful sessions.
Any alerts related to file access or unusual backend activity (if your environment surfaces these events).

Technical context

CVE-2021-20023 is an arbitrary file read issue (CWE-22) in SonicWall Email Security versions in the 10.0.9.x series. The mechanism is improper input validation that allows a post-authenticated attacker (someone who can successfully log in) to read arbitrary files on the remote host; no user interaction is required.

Exploitation status: This vulnerability is listed in the CISA KEV and is reported as used in ransomware campaigns, which indicates confirmed real-world abuse. No public exploit code is noted in the findings.

EPSS: A predicted likelihood value was provided (not used as the primary driver here because KEV confirmation takes precedence). The “patch” findings provide explicit fixed versions for each product line.

Attack vector: Network-based; precondition is attacker credentials (authenticated access).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Listed as exploited in the wild since 2021-11-03.

US federal agencies must remediate by 2021-11-17.

Known use in ransomware campaigns.

Apply updates per vendor instructions.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

51% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 1940 days, from the signal feeds we watch.

2026-08-12Patch availablerecord updated
2026-06-25OpenVAS check added
2026-05-11EPSS band changemoderate → high
2025-11-12Patch availablerecord updated
2021-11-03Added to CISA KEVransomware campaign
2021-04-20Publishedweakness classified, att&ck mapped

Affected products

SonicWallcommercial · US

And 5 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Scored 4.9 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact