Is CVE-2021-20028 (SonicWall Secure Remote Access (SRA) SQL Injection) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2021-20028 to its Known Exploited Vulnerabilities catalogue on 28 March 2022, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. SonicWall Secure Remote Access (SRA) products contain an improper neutralization of a SQL Command leading to SQL injection.

What active exploitation means for this SonicWall SRA CVE

This is not just a product bug with theoretical risk. Once CISA places a vulnerability in the Known Exploited Vulnerabilities catalogue, the operational assumption should shift to active attacker interest, with exposure focused on internet-facing remote access appliances and the credentials, sessions, or internal footholds they can broker. Treat the issue as an exploitation and containment problem, not a routine maintenance item.

For edge and remote access appliances, the first question is whether the vulnerable SRA instance is still reachable from the internet and whether it is being used as a trust boundary for remote users, administrators, or partners. NHIMG’s Edge Device Security Guide and Remote Access Identity Guide both reflect the same operational reality: exposed management and remote access paths deserve faster triage than ordinary internal software.

The fact pattern also matters because SQL injection on a remote access platform is often a pre-authentication or low-friction entry path into a privileged service. That means the issue can sit at the intersection of application security and access control, where one flaw may expose configuration data, authentication material, or paths into adjacent systems. A general defence approach is outlined in NHIMG’s SQL Injection Prevention Guide, while the broader vulnerability-handling workflow is covered in the Vulnerability Management Guide.

Why KEV listing changes the response

CISA KEV inclusion is a practical signal, not a score. It means the vulnerability has crossed the threshold where exploitation is credible enough to drive urgent remediation, compensating controls, and executive attention. For practitioners, that usually changes prioritisation more than it changes the technical fix itself: exposure should be verified, mitigation should be accelerated, and any remote access service using the affected product should be treated as potentially targetable.

Because KEV entries are intended to guide operational response, authoritative references should be used for exact product coverage and remediation instructions. The official CISA Known Exploited Vulnerabilities Catalog and the NIST National Vulnerability Database are the right places to confirm the record, while the CVE Program anchors the identifier and record structure.

If patching cannot happen immediately, the response should not stop at “monitor closely.” Restrict or remove internet exposure where possible, isolate the appliance, disable unused interfaces or functions, and assume the device may already have been probed. On SonicWall-class remote access systems, a conservative stance is to reduce reachability first and investigate later, because active exploitation tends to move faster than standard change windows.

What to check before you declare it contained

Look for signs that the appliance was accessed before remediation: unexpected authentication events, new admin actions, unfamiliar configuration changes, unusual outbound connections, or logs that suggest the device was used as a pivot point. The key question is not only whether the SQL injection was possible, but whether it already enabled broader compromise of remote access accounts or adjacent internal resources.

If there is any chance the appliance exposed credentials, sessions, or privileged access paths, rotate the relevant secrets and review linked accounts, especially administrative or service credentials tied to the remote access stack. CISA’s ransomware note raises the stakes further, because exploitation in the wild often means the vulnerability is useful for follow-on intrusion rather than isolated scanning. In practice, that makes credential review and session invalidation part of containment, not a separate cleanup task.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes urgent vuln prioritisation and remediation central.
	CIS-12 — Network Infrastructure Management	Internet-facing SRA appliances are network edge assets whose exposure must be reduced or isolated.
Recommendation — Prioritise and remediate KEV-listed exposure immediately, using validated vulnerability inventory and exception tracking. Restrict, segment, and harden exposed edge appliances before normal change cycles.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	KEV-listed exploitation requires fast identification, triage, and exposure validation.
	IR-4 — Incident Handling	Known exploitation requires compromise assessment and response actions, not just patching.
	IA-5 — Authenticator Management	SQLi on a remote access platform can expose credentials, sessions, or access paths.
Recommendation — Scan, validate, and track the vulnerable appliance until remediation is complete. Investigate for compromise and execute containment when exploitation is suspected. Rotate exposed credentials and invalidate compromised sessions or tokens.

Practitioner Guidance

What to prioritise: Confirm whether the SRA instance is internet-facing, whether it is still needed, and whether it sits on a path to privileged access. If the answer is yes on all three, treat the vulnerability as urgent even before you finish full forensics.

Decision rule: If patching is delayed, reduce exposure first, then hunt for compromise. Do not wait for complete certainty before taking the appliance out of the blast radius, because KEV-listed flaws are already beyond the “watch and wait” stage.

What to verify: Check whether logs, auth records, and configuration history can still support a credible pre-remediation review. If the platform cannot prove absence of abuse, assume the review is incomplete and narrow access accordingly.

Practitioner takeaway: For KEV-listed remote access vulnerabilities, the operational objective is to prove exposure, shrink reachability, and rule out compromise in that order, not to wait for a perfect patch window.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org