CISA is aware of three vulnerabilities affecting SonicWall Email Security products: CVE-2021-20021, CVE-2021-20022, and CVE-2021-20023. A remote attacker could exploit these vulnerabilities to take control of an affected system. According to SonicWall, "In at least one known case, these vulnerabilities have been observed to be exploited ‘in the wild.’"
CISA encourages users and administrators to review the SonicWall security advisory and apply the necessary update as soon as possible. Note: SonicWall released patches for CVE-2021-20021 and CVE-2021-20022 on April 9, 2021, and for CVE-2021-20023 on April 20, 2021.
This product is provided subject to this Notification and this Privacy & Use policy.