CVE-2021-20023

This vulnerability lets someone who already has a valid login use the product to view files on the server that should not be readable. Think of it like a “locked office” where a person with a badge can open any drawer and look inside—so if an attacker gets credentials, they can steal sensitive information. Even though this specific flaw is about reading files (not changing them), that stolen information can help attackers run ransomware and stay hidden.

This matters if your business uses SonicWall Email Security, Hosted Email Security, or one of the listed SonicWall Email Security Appliance firmware lines (including Email Security Virtual Appliance). Because the issue needs a valid authenticated session, it is most relevant when attackers can obtain credentials (for example, via phishing, stolen passwords, or reused logins). It is a risk only when the affected product is reachable to attackers and there is a valid path for authentication attempts (and attackers already have credentials).

This is RED because the flaw is confirmed in the CISA KEV and was used in ransomware campaigns—meaning real attackers have already used it in the wild. Your fastest path to reducing risk is to upgrade to the fixed versions listed for your exact SonicWall deployment.