SonicWall Email Security Appliance 7000 Firmware vulnerabilities

5 CVEs affecting SonicWall Email Security Appliance 7000 Firmware, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-40605, published 2025-11-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-20021: SonicWall Email Security Improper Privilege Management Vulnerability, published 2021-04-09. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 88.8% chance of exploitation in the next 30 days. A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
CVE-2021-20023: SonicWall Email Security Path Traversal Vulnerability, published 2021-04-20. Medium severity, CVSS 4.9. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 51.7% chance of exploitation in the next 30 days. SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on the remote host.
CVE-2021-20022: SonicWall Email Security Unrestricted Upload of File Vulnerability, published 2021-04-09. High severity, CVSS 7.2. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 16.6% chance of exploitation in the next 30 days. SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.
CVE-2025-40605, published 2025-11-20. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted directory-traversal sequences (such as ../)…
CVE-2025-40604, published 2025-11-20. Critical severity, CVSS 9.8. EPSS: 0.2% chance of exploitation in the next 30 days. Download of Code Without Integrity Check Vulnerability in the SonicWall Email Security appliance loads root filesystem images without verifying signatures, allowing attackers with VMDK or datastore…