CVE-2021-20022: SonicWall Email Security Unrestricted Upload of File Vulnerability

High severity, CVSS 7.2. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 16.6% chance of exploitation in the next 30 days.

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.

Affected products

• SonicWall Email Security: before 10.0.9.6103 (fixed in 10.0.9.6103)
• SonicWall Email Security Appliance 3300 Firmware: before 10.0.9.6105 (fixed in 10.0.9.6105)
• SonicWall Email Security Appliance 4300 Firmware: before 10.0.9.6105 (fixed in 10.0.9.6105)
• SonicWall Email Security Appliance 5000 Firmware: before 10.0.9.6105 (fixed in 10.0.9.6105)
• SonicWall Email Security Appliance 5050 Firmware: before 10.0.9.6105 (fixed in 10.0.9.6105)
• SonicWall Email Security Appliance 7000 Firmware: before 10.0.9.6105 (fixed in 10.0.9.6105)
• SonicWall Email Security Appliance 7050 Firmware: before 10.0.9.6105 (fixed in 10.0.9.6105)
• SonicWall Email Security Appliance 8300 Firmware: before 10.0.9.6105 (fixed in 10.0.9.6105)
• SonicWall Email Security Appliance 9000 Firmware: before 10.0.9.6105 (fixed in 10.0.9.6105)
• SonicWall Email Security Virtual Appliance: before 10.0.9.6105 (fixed in 10.0.9.6105)
• SonicWall Hosted Email Security: before 10.0.9.6103 (fixed in 10.0.9.6103)

Published 2021-04-09. Last modified 2026-10-01.