CVE-2021-20022VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2021-20022: SonicWall Email Security Unrestricted Upload of File Vulnerability

Affects SonicWall SonicWall Email SecuritySource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 11/17/2021
Ransomware: Used in ransomware campaigns
EPSS: 16.6% chance of exploitation in 30 days – higher than 97% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-20022 (opens in a new tab)

Description

CVE-2021-20022 is a vulnerability in SonicWall Email Security that allows a post-authenticated attacker to upload files of dangerous types to the remote host. This vulnerability is part of an exploit chain with CVE-2021-20021 and CVE-2021-20023, enabling privilege escalation. It has been exploited in the wild and is known to be used in ransomware campaigns.

Summary

SonicWall Email Security contains an unrestricted file upload vulnerability (CWE-434) that permits authenticated attackers to upload malicious files to the system. This flaw is exploited in combination with two other vulnerabilities (CVE-2021-20021 and CVE-2021-20023) to escalate privileges on the affected system. The vulnerability has been observed in active exploit campaigns, including ransomware operations.

Impact

Successful exploitation allows an authenticated attacker to upload arbitrary files, potentially leading to privilege escalation and full system compromise. The vulnerability has been actively exploited in the wild and leveraged in ransomware campaigns, indicating significant risk to affected organizations.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to SonicWall Email Security interfaces to trusted users only and monitor for suspicious activity related to file uploads.

Weaknesses

CWE-434Unrestricted File Upload (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:55:35 UTC

Weaknesses

References

Related threats