# Canon's GUARDIANWALL MailSuite has a critical stack-based buffer overflow…

Published: 2026-05-12 · Severity: critical
Canonical: https://vorant.io/reports/62bbc0ed-5943-4f21-bcf3-fb39f803640b/canon-s-guardianwall-mailsuite-has-a-critical-stack-based-buffer-overflow

> Canon's GUARDIANWALL MailSuite has a critical stack-based buffer overflow (CVE-2026-32661) allowing remote code execution; active exploitation confirmed on on-premises versions.

Canon Marketing Japan's GUARDIANWALL MailSuite, an email security product, contains a stack-based buffer overflow vulnerability tracked as CVE-2026-32661. The flaw affects both the on-premises version (Ver 1.4.00 through Ver 2.4.26) and the SaaS cloud version prior to the April 30, 2026 maintenance. An attacker can exploit this vulnerability by sending a specially crafted request to the product's web service, potentially achieving arbitrary code execution.

According to the vendor, active exploitation of this vulnerability has already been observed in the wild against on-premises deployments of GUARDIANWALL MailSuite. This makes immediate patching critical for affected organizations. The SaaS version was remediated on April 30, 2026, but on-premises customers must apply patches manually.

The Japan CERT (IPA) has assigned this vulnerability a CVSS v3 score of 9.8 (Critical). The vendor is providing patches and recommends applying workarounds for systems that cannot be immediately patched. Organizations using GUARDIANWALL MailSuite should prioritize this update given the confirmed exploitation activity.

## Mentioned in this report

- Vulnerabilities: CVE-2026-32661

## Detection guidance (public sample)

### Suspicious Child Process from GUARDIANWALL MailSuite Web Service (Possible CVE-2026-32661 Exploitation)

ATT&CK: T1190

Detects command/script interpreters spawned by the GUARDIANWALL MailSuite web service process, consistent with post-exploitation of the stack-based buffer overflow (CVE-2026-32661) enabling arbitrary code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process from GUARDIANWALL MailSuite Web Service
id: f0496916-3d32-52c2-82c9-fcb5ef02d7e5
status: experimental
description: 'Detects execution of command interpreters or scripting engines spawned
  directly from the GUARDIANWALL MailSuite web service process. This behavior is consistent
  with exploitation of CVE-2026-32661, a critical stack-based buffer overflow in the
  on-premises MailSuite web service that allows arbitrary code execution when a crafted
  request is processed.

  '
references:
- https://www.canon-mkt.co.jp
author: Vorant
tags:
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
    - guardianwall
    - mailsuite
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \cscript.exe
    - \wscript.exe
    - \bash.exe
    - \sh.exe
    - \rundll32.exe
    - \mshta.exe
  filter:
    CommandLine|contains:
    - HealthCheck
    - ServiceControl
  condition: selection_parent and selection_child and not filter
falsepositives:
- Legitimate administrative scripts or scheduled maintenance tasks configured to be
  launched by the mail security service
- Vendor-provided diagnostic or health-check scripts invoked by the web service
level: high
```

### Unusual Outbound Network Connection from Mail Security Web Service Process

ATT&CK: T1203

Detects the GUARDIANWALL MailSuite web service process initiating outbound network connections, which may indicate a reverse shell or C2 callback following successful exploitation of CVE-2026-32661. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unusual Outbound Connection from Mail Security Web Service Process
id: fc018e4d-8a73-53c1-98b8-4b62b8fc41df
status: experimental
description: 'Detects outbound network connections initiated by the GUARDIANWALL MailSuite
  web service process. Email security web services normally only accept inbound connections;
  an outbound connection initiated by this process may indicate successful exploitation
  of CVE-2026-32661 leading to a reverse shell or command-and-control callback.

  '
references:
- https://www.canon-mkt.co.jp
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains:
    - guardianwall
    - mailsuite
    Initiated: 'true'
  filter:
    DestinationPort:
    - 53
    - 123
    - 389
    - 636
  condition: selection and not filter
falsepositives:
- Legitimate update or license-check connections made by the mail security appliance
  to vendor servers
- Authorized outbound integrations such as SMTP relay or directory service lookups
  configured for the appliance
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2026/20260513-jvn.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/62bbc0ed-5943-4f21-bcf3-fb39f803640b/canon-s-guardianwall-mailsuite-has-a-critical-stack-based-buffer-overflow.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup