Skip to content
Fencer Vulns
high 7.2

CVE-2021-20022 kev+ ransomware in the critical feed json

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to…

published 2021-04-09 5 y ago modified 2026-10-01 38 d ago also EUVD-2021-7485

cvss
7.2
version 3.1, CNA
cisa kev
Exploited
added 2021-11-03, used in ransomware
epss
16.6%
EPSS 16.6% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • sonicwall email_security 10.0.9.6103
  • sonicwall email_security_virtual_appliance 10.0.9.6105
  • sonicwall hosted_email_security 10.0.9.6103
  • sonicwall email_security_appliance_9000_firmware 10.0.9.6105
  • sonicwall email_security_appliance_3300_firmware 10.0.9.6105
  • sonicwall email_security_appliance_4300_firmware 10.0.9.6105
  • sonicwall email_security_appliance_8300_firmware 10.0.9.6105
  • sonicwall email_security_appliance_5000_firmware 10.0.9.6105
  • sonicwall email_security_appliance_7000_firmware 10.0.9.6105
  • sonicwall email_security_appliance_5050_firmware 10.0.9.6105
  • sonicwall email_security_appliance_7050_firmware 10.0.9.6105

Timeline

  1. Published
  2. Added to CISA KEV
  3. CISA patch deadline
  4. CISA SSVC: exploitation active

Known exploited

Added
5 y ago
Patch by
2021-11-17 (4 y ago)
Ransomware
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor, product
SonicWall, SonicWall Email Security
CISA name
SonicWall Email Security Unrestricted Upload of File Vulnerability

Ransomware

Groups reported to have exploited it in intrusions.

  • FiveHands ransomware gang
  • HelloKitty ransomware gang

reported by cloud.google.comic3.gov

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
2 mo ago

Exploit prediction

16.64% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • SonicWall Email Security

Classification

Weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.