Is CVE-2021-20023 (SonicWall Email Security Path Traversal) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 18, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2021-20023 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. SonicWall Email Security contains a path traversal vulnerability that allows a post-authenticated attacker to read files on the remote host.

How active exploitation changes the response

CISA’s KEV listing means this is not just a theoretical SonicWall Email Security flaw. For a path traversal issue, the practical question is whether the appliance is exposed, whether the vulnerable path can be reached after authentication, and whether attackers could already have used it to inspect files that matter for mail flow, configuration, or stored secrets.

For readers deciding whether to treat it as urgent, the answer is yes if the product is internet-facing, reachable by administrators, or part of a broader email security stack that protects a large user population. The fact that CISA also associates it with ransomware raises the priority of exposure review, not just patch planning.

Start with the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog for the authoritative remediation path and any required action, then confirm your own deployment state before assuming you are unaffected.

What path traversal means here

Path traversal in an email security appliance is dangerous because the appliance typically sits at a trust boundary and can hold sensitive operational data. If an attacker can read arbitrary files, they may reach configuration material, logs, mail routing details, or other host files that help them understand the environment or support follow-on access.

The key practical distinction is that this is a post-authenticated issue. That means perimeter filtering alone is not enough, because the attacker may only need legitimate access to a reachable management or application surface to pivot into file reads. In appliance environments, that often turns a single flaw into a much broader disclosure problem.

This is why the subject is treated as both a vulnerability management issue and an exposure issue. The first-order risk is unauthorized file read, but the second-order risk is what those files reveal about mail infrastructure, credentials, integrations, and administrative pathways.

What to check before and after remediation

Confirm whether SonicWall Email Security is deployed in a way that allows the affected functionality to be reached, then review whether any administrative or application access could have been abused before you patched. If the appliance stores logs, backups, config exports, tokens, or integration details locally, assume those are the highest-value targets for compromise assessment.

Review indicators that matter for this class of issue: unexpected file access patterns, unusual admin activity, changes in appliance configuration, and signs that logs or mail security settings were viewed or exported. If the device supports centralized logging, compare appliance events with your SIEM to establish whether the exploit path was exercised during the exposure window.

If patching was delayed, treat the interval as a potential compromise window. In that case, validate whether credentials or session material stored or referenced by the appliance should be rotated, especially where the device integrates with downstream mail, directory, or management systems.

Risk and Threat Considerations

Because this vulnerability can expose files on a remote host, the risk is not limited to one appliance. The larger concern is disclosure of configuration or secret material that can be reused for lateral movement, mail compromise, or persistence, especially in environments where the email security platform is trusted by design.

Failure mechanism: An authenticated attacker reaches a file read condition through path traversal, then uses the disclosed files to recover sensitive operational details or credentials that expand access beyond the original appliance.

Impact: The result can include mail security bypass, administrative exposure, broader network compromise, or ransomware enablement if the appliance reveals material that helps an attacker move deeper into the environment.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	Active exploitation calls for urgent vuln triage and exposure confirmation.
	SI-2 — Flaw Remediation	The issue requires fixing the product flaw and verifying remediation took effect.
Recommendation — Prioritise remediation and validation for KEV-listed vulnerabilities using urgency-based risk triage. Apply vendor remediation promptly and verify the vulnerable service is no longer exposed.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV status makes continuous prioritisation and response to exploited flaws directly relevant.
Recommendation — Escalate KEV-listed flaws and track them to verified remediation with deadlines.
MITRE ATT&CK	T1005 — Data from Local System	Path traversal can be used to read local files from the target host.
Recommendation — Hunt for local-file access patterns that indicate disclosure from the appliance.
OWASP ASVS	V4 — API and Web Service	A traversal flaw in a web-accessible service is a web-service security failure mode.
Recommendation — Review web-facing service inputs for traversal and enforce server-side path validation.

Practitioner Guidance

What to verify: Confirm whether the appliance is internet-facing, whether any privileged access paths were available during the exposure window, and whether local files could contain reusable secrets, backups, or integration data. If you cannot rule out access, assume the environment needs compromise review, not just patching.

Decision rule: If the device was reachable and you have no high-confidence evidence that the flaw was never exercised, prioritise file-integrity review, log review, and credential rotation before declaring the incident closed. If the device was isolated and tightly monitored, the response can focus more heavily on patch validation and short-term monitoring.

Practitioner takeaway: For KEV-listed appliance flaws, the real question is whether the vulnerability exposed anything an attacker can reuse. Patch quickly, but validate exposure and search for what the file read may have revealed.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org