What is the CVSS score of CVE-2021-20022?

CVE-2021-20022 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 16.5%.

Is CVE-2021-20022 being actively exploited?

Yes, CVE-2021-20022 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

Email Security Appliance 5000 Firmware CVE-2021-20022

HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2021-04-09 PSIRT@sonicwall.com

File Upload Sonicwall Email Security Appliance 5000 Firmware Email Security Appliance 5050 Firmware Email Security Appliance 7000 Firmware Email Security Appliance 7050 Firmware Email Security Appliance 9000 Firmware Email Security Email Security Virtual Appliance Email Security Appliance 3300 Firmware Email Security Appliance 4300 Firmware Email Security Appliance 8300 Firmware Hosted Email Security

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Jul 14, 2026 - 04:22 CISA

CVE Published

Apr 09, 2021 - 18:15 nvd

HIGH 7.2

DescriptionNVD

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host.

AnalysisAI

SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote host. Affected products include: Sonicwall Email Security, Sonicwall Email Security Appliance 9000 Firmware, Sonicwall Email Security Appliance 3300 Firmware, Sonicwall Email Security Appliance 4300 Firmware, Sonicwall Email Security Appliance 8300 Firmware. Version information: version 10.0.9..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.