SonicWall Email Security 10.0.x End of Life: April 30, 2027
SonicWall Email Security 10.0.x reaches End of Support on April 30, 2027. The Email Security software table on SonicWall's own Product Life Cycle Tables page prints that End of Support date against the three 10.0.x releases still in support: 10.0.36, 10.0.35 and 10.0.31. None of the three is in full support today. 10.0.35 and 10.0.31 entered Limited Support on April 1, 2026, and 10.0.36, released August 11, 2026, carries a Limited Support date of August 12, 2026, one day later.
The 10.0.x releases still in support
SonicWall gives each Email Security release its own row and its own dates, and labels it a general release (GR) or a maintenance release (MR). These are the three rows whose End of Support date has not yet passed, with the dates as we serve them on the SonicWall Email Security page:
| Version | Type | Release date | Limited Support | End of Support |
|---|---|---|---|---|
| 10.0.36 | MR | August 11, 2026 | August 12, 2026 | April 30, 2027 |
| 10.0.35 | MR | March 31, 2026 | April 1, 2026 | April 30, 2027 |
| 10.0.31 | GR | December 13, 2024 | April 1, 2026 | April 30, 2027 |
The rest of the 10.0.x line is already past End of Support. The nine other rows from 10.0.21 to 10.0.34 (10.0.21, 10.0.24, 10.0.25, 10.0.26, 10.0.28, 10.0.29, 10.0.30, 10.0.33 and 10.0.34) entered Limited Support on April 1, 2026 and reached End of Support on June 1, 2026. A system on any of them is on a release SonicWall no longer patches or offers for download, and the move to 10.0.36 is the first step in any plan.
The table lists no release after 10.0.36. The page also carries a reservation that applies to every row: "SonicWall reserves the right to modify the above support timelines for product security reasons or in the event the relevant product is obsolete or no longer commercially viable." If SonicWall adds a release or moves a date, the SonicWall Email Security page picks it up at the next build.
The Email Security appliances end the next day
The same page carries a separate hardware table for the Email Security appliances, with SonicWall's five hardware phases instead of the three software ones. For the ES 5000, ES 5050, ES 7000, ES 7050 and ES 9000 the table prints a Last Order Day of April 30, 2026 and End of Support on May 1, 2027, the day after the 10.0.x software dates end. In SonicWall's definition, End of Support for hardware means it "will no longer provide technical support, firmware updates/upgrades or hardware replacement for the product". Every appliance and its dates are on the SonicWall Email Security appliances page.
Security exposure
This is a product attackers have gone after before. SonicWall Email Security has 3 entries in CISA's Known Exploited Vulnerabilities (KEV) catalog, and CISA flags known ransomware campaign use on 3 of them. CISA describes the three as one exploit chain: an attacker creates an administrative account with a crafted HTTP request, then uses the file-upload and path-traversal flaws after authenticating.
| CVE | Added to KEV | CISA's name for it |
|---|---|---|
| CVE-2021-20021 | Nov 3, 2021 | Improper Privilege Management |
| CVE-2021-20022 | Nov 3, 2021 | Unrestricted Upload of File |
| CVE-2021-20023 | Nov 3, 2021 | Path Traversal |
The catalog's required action for each entry is "Apply updates per vendor instructions." These are 2021 flaws, not a reason by themselves to think a current 10.0.x system is exposed. The point is the one SonicWall's own phase definitions make: while a release is in Limited Support a fix for a newly found flaw is at SonicWall's discretion, and after April 30, 2027 no new patches are promised for any 10.0.x release. An email gateway faces the internet by design, so that gap matters more here than on an internal system.
What to do
- Find every Email Security deployment and note its release, including standby or secondary systems that are easy to forget.
- Move anything below 10.0.31 to 10.0.36 now. Those releases reached End of Support on June 1, 2026; 10.0.36 is the newest release on the table and runs to the same end date as 10.0.35 and 10.0.31.
- Check your appliance model against the hardware table. An ES 5000, 5050, 7000, 7050 or 9000 reaches End of Support on May 1, 2027, so a software upgrade alone does not carry it past that date.
- Plan the replacement now. Ask SonicWall what it offers Email Security customers after these dates, and budget the migration of mail flow, policies and quarantine now rather than in the last month.
Frequently Asked Questions
When does SonicWall Email Security 10.0 reach end of life?
SonicWall's Product Life Cycle Tables page lists End of Support on April 30, 2027 for Email Security 10.0.36, 10.0.35 and 10.0.31, the 10.0.x releases still in support. The other 10.0.x releases on the table have already reached End of Support.
Is SonicWall Email Security 10.0.36 still getting fixes?
The lifecycle table puts 10.0.36 in Limited Support from August 12, 2026, the day after its release. SonicWall defines Limited Support as support with best efforts to provide known workarounds or fixes, where no new code fixes will be generated except under extreme circumstances and at SonicWall's discretion.
Has SonicWall Email Security been exploited?
Yes. CISA's Known Exploited Vulnerabilities catalog lists three SonicWall Email Security vulnerabilities, CVE-2021-20021, CVE-2021-20022 and CVE-2021-20023, used together in one exploit chain. CISA added all three on November 3, 2021 and marks each as known to be used in ransomware campaigns.
Related
- SonicWall Email Security — every version and its dates
- SonicWall Email Security appliances — Last Order Day and End of Support for every ES model
- SonicWall Firewalls — hardware dates for TZ, NSa and NSsp models
- SonicWall NSM On-Prem end of support — the same lifecycle table, applied to the firewall manager