Sonicwall Email Security — known CVE vulnerabilities

Every CVE whose affected-product data names Sonicwall Email Security, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (12)

• CVE-2021-44228 — CVSS 10.0 (critical) — actively exploited: Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log…
• CVE-2021-20021 — CVSS 9.8 (critical) — actively exploited: A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a…
• CVE-2021-45046 — CVSS 9.0 (critical) — actively exploited: It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could…
• CVE-2021-3450 — CVSS 7.4 (high): The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by…
• CVE-2021-20022 — CVSS 7.2 (high) — actively exploited: SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to…
• CVE-2021-45105 — CVSS 5.9 (medium): Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from…
• CVE-2018-3639 — CVSS 5.5 (medium): Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior…
• CVE-2023-0655 — CVSS 5.3 (medium): SonicWall Email Security contains a vulnerability that could permit a remote unauthenticated attacker access to an error page that includes…
• CVE-2021-20023 — CVSS 4.9 (medium) — actively exploited: SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to read an arbitrary file on…
• CVE-2026-3468 — CVSS 4.8 (medium): A stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email Security appliance due to improper…
• CVE-2026-3470 — CVSS 3.8 (low): A vulnerability exists in the SonicWall Email Security appliance due to improper input sanitization that may lead to data corruption…
• CVE-2026-3469 — CVSS 2.7 (low): A denial-of-service (DoS) vulnerability exists due to improper input validation in the SonicWall Email Security appliance, allowing a…