CVE-2021-20021: SonicWall Email Security improper privilege management allows admin account creation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated remote administrative account creation on an internet-facing email security appliance, with KEV listing, ransomware association and very high EPSS probability.

What it is

SonicWall Email Security 10.0.9.x contains an improper privilege management flaw that lets an attacker create an administrative account by sending a crafted HTTP request to the remote host. Because the resulting account is administrative, a successful hit gives full control of the email security appliance, which sits in a sensitive position handling mail flow and credentials.

Impact

An unauthenticated attacker gains a working administrative account on the appliance, yielding full control over its configuration, mail handling and any data it processes.

Attack surface

Reachable over the network via a crafted HTTP request to the remote host; the CVSS vector shows no privileges and no user interaction required. No further detail on the specific endpoint or request shape is provided in the record.

Exploitation

Listed in CISA KEV with a due date of 2021-11-17 and flagged for known ransomware campaign use, and EPSS gives a 30-day probability of 0.834 (99.7th percentile), indicating active exploitation.

What to do

• Apply the vendor update per the SonicWall PSIRT advisory SNWLID-2021-0007; treat this as the first and mandatory step.
• If patching cannot be done immediately, restrict network access to the Email Security management interface to trusted administrative networks only.
• Audit local accounts on all Email Security appliances and hosted instances for unexpected or newly created administrative users, and remove any that are not authorized.
• Rotate credentials and review mail-flow and configuration changes made since exposure, since an attacker-created admin account may have been used for follow-on activity.
• Monitor CISA KEV guidance and vendor advisories for updated remediation instructions.

Detection

• Review Email Security appliance logs for unexpected administrative account creation events and for HTTP requests to account-management endpoints from untrusted sources.
• Alert on new or modified admin accounts on Email Security appliances and correlate with source IP reputation and geolocation.
• Hunt for authentication from newly created admin accounts, especially logins from IPs not previously seen administering the appliance.
• Monitor for configuration changes, mail rule modifications or data exfiltration consistent with post-exploitation of an email security appliance.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.