The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a renewed warning regarding CVE-2021-20035, a high-severity remote code execution (RCE) vulnerability affecting SonicWall Secure Mobile Access (SMA) 100 Series devices (including models 200, 210, 400, 410, and 500v) following confirmed evidence of active exploitation. Initially disclosed in 2021 and originally thought to only enable denial-of-service (DoS) attacks, this operating system command injection flaw arises from improper neutralization of special elements in the SMA100 management interface. It allows remote, authenticated attackers with low privileges to execute arbitrary commands as the “nobody” user, potentially leading to full code execution. The impacted versions include firmware 10.2.1.0-17sv, 10.2.0.7-34sv, and 9.0.0.10-28sv and earlier, with fixes available in subsequent releases. SonicWall recently revised its advisory to reflect the exploit’s seriousness, raising the CVSS score to 7.2/10 and acknowledging active exploitation in-the-wild. CISA has since added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, and under Binding Operational Directive 22-01, all Federal Civilian Executive Branch (FCEB) agencies are required to patch affected systems by May 7, 2025. While this directive applies to federal entities, CTIX analysts strongly urge all organizations to prioritize remediation due to the widespread risk posed by such vulnerabilities.