Canon's GUARDIANWALL MailSuite has a critical stack-based buffer overflow…

Canon's GUARDIANWALL MailSuite has a critical stack-based buffer overflow (CVE-2026-32661) allowing remote code execution; active exploitation confirmed on on-premises versions.

Canon Marketing Japan's GUARDIANWALL MailSuite, an email security product, contains a stack-based buffer overflow vulnerability tracked as CVE-2026-32661. The flaw affects both the on-premises version (Ver 1.4.00 through Ver 2.4.26) and the SaaS cloud version prior to the April 30, 2026 maintenance. An attacker can exploit this vulnerability by sending a specially crafted request to the product's web service, potentially achieving arbitrary code execution.

According to the vendor, active exploitation of this vulnerability has already been observed in the wild against on-premises deployments of GUARDIANWALL MailSuite. This makes immediate patching critical for affected organizations. The SaaS version was remediated on April 30, 2026, but on-premises customers must apply patches manually.

The Japan CERT (IPA) has assigned this vulnerability a CVSS v3 score of 9.8 (Critical). The vendor is providing patches and recommends applying workarounds for systems that cannot be immediately patched. Organizations using GUARDIANWALL MailSuite should prioritize this update given the confirmed exploitation activity.

title: Suspicious Child Process from GUARDIANWALL MailSuite Web Service
id: f0496916-3d32-52c2-82c9-fcb5ef02d7e5
status: experimental
description: 'Detects execution of command interpreters or scripting engines spawned
  directly from the GUARDIANWALL MailSuite web service process. This behavior is consistent
  with exploitation of CVE-2026-32661, a critical stack-based buffer overflow in the
  on-premises MailSuite web service that allows arbitrary code execution when a crafted
  request is processed.

  '
references:
- https://www.canon-mkt.co.jp
author: Vorant
tags:
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - guardianwall
    - mailsuite
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \cscript.exe
    - \wscript.exe
    - \bash.exe
    - \sh.exe
    - \rundll32.exe
    - \mshta.exe
  filter:
    CommandLine|contains:
    - HealthCheck
    - ServiceControl
  condition: selection_parent and selection_child and not filter
falsepositives:
- Legitimate administrative scripts or scheduled maintenance tasks configured to be
  launched by the mail security service
- Vendor-provided diagnostic or health-check scripts invoked by the web service
level: high

title: Unusual Outbound Connection from Mail Security Web Service Process
id: fc018e4d-8a73-53c1-98b8-4b62b8fc41df
status: experimental
description: 'Detects outbound network connections initiated by the GUARDIANWALL MailSuite
  web service process. Email security web services normally only accept inbound connections;
  an outbound connection initiated by this process may indicate successful exploitation
  of CVE-2026-32661 leading to a reverse shell or command-and-control callback.

  '
references:
- https://www.canon-mkt.co.jp
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains:
    - guardianwall
    - mailsuite
    Initiated: 'true'
  filter:
    DestinationPort:
    - 53
    - 123
    - 389
    - 636
  condition: selection and not filter
falsepositives:
- Legitimate update or license-check connections made by the mail security appliance
  to vendor servers
- Authorized outbound integrations such as SMTP relay or directory service lookups
  configured for the appliance
level: medium

Source reporting: https://www.ipa.go.jp/security/security-alert/2026/20260513-jvn.html