Canon GUARDIANWALL MailSuite exploited via buffer overflow
A critical stack-based buffer overflow in Canon GUARDIANWALL MailSuite is being actively exploited, allowing arbitrary code execution via crafted web requests.
Canon Marketing Japan's GUARDIANWALL MailSuite, a mail security product, contains a critical stack-based buffer overflow vulnerability (CVE-2026-32661) with a CVSS score of 9.8. The flaw affects both the on-premises version (Ver 1.4.00 to Ver 2.4.26) and the SaaS cloud version prior to the April 30, 2026 maintenance update.
According to the vendor, active exploitation of this vulnerability has been confirmed in the wild against the on-premises version of GUARDIANWALL MailSuite. Attackers can exploit the flaw by sending specially crafted requests to the product's web service, enabling arbitrary code execution on vulnerable systems.
The SaaS cloud version was patched on April 30, 2026. Canon Marketing Japan has released patches for the on-premises version and recommends applying workarounds until patches can be deployed. The Japan Computer Emergency Response Team (JPCERT/CC) and IPA have issued advisories urging immediate patching.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by GUARDIANWALL MailSuite Service
Detects command interpreters or scripting engines spawned by the GUARDIANWALL MailSuite web service process, indicative of post-exploitation following a buffer overflow (CVE-2026-32661). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by GUARDIANWALL MailSuite Service
id: 0dae64b0-0025-5956-bf90-559971461e81
status: experimental
description: Detects command interpreters, shells, or scripting engines launched as
a child process of the GUARDIANWALL MailSuite mail security service, consistent
with exploitation of CVE-2026-32661 (stack-based buffer overflow) leading to arbitrary
code execution.
references:
- JPCERT/CC advisory on GUARDIANWALL MailSuite CVE-2026-32661
author: Vorant
tags:
- attack.t1190
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- guardianwall
- mailsuite
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
- \rundll32.exe
- \mshta.exe
- \bash.exe
- \sh.exe
- \certutil.exe
filter:
CommandLine|contains:
- \Program Files\GUARDIANWALL\Maintenance\
condition: selection_parent and selection_child and not filter
falsepositives:
- Legitimate scheduled maintenance or update scripts invoked by the mail suite service
- Administrative diagnostics performed via vendor-provided management scripts
level: high
GUARDIANWALL MailSuite Process Making Outbound Network Connection
Detects the GUARDIANWALL MailSuite service process initiating outbound network connections, which may indicate a reverse shell or C2 callback established after successful exploitation of the buffer overflow vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: GUARDIANWALL MailSuite Process Making Outbound Network Connection
id: 7c4ccb33-9eaa-5314-8275-c67dcaf57411
status: experimental
description: Detects the GUARDIANWALL MailSuite service binary initiating outbound
network connections to non-standard mail/web ports, potentially indicating a reverse
shell or command-and-control channel established after exploitation of CVE-2026-32661.
references:
- JPCERT/CC advisory on GUARDIANWALL MailSuite CVE-2026-32661
author: Vorant
tags:
- attack.t1190
- attack.t1203
logsource:
category: network_connection
product: windows
detection:
selection:
Image|contains:
- guardianwall
- mailsuite
filter_ports:
DestinationPort:
- 25
- 465
- 587
- 143
- 993
- 80
- 443
condition: selection and not filter_ports
falsepositives:
- Legitimate mail relay or update-check connections made by the service on non-listed
ports
- Vendor telemetry or license validation traffic to external endpoints
level: medium
Web Shell File Write by GUARDIANWALL MailSuite Web Service
Detects creation of script or executable files in the web-accessible directories of the GUARDIANWALL MailSuite service, consistent with web shell deployment following exploitation of CVE-2026-32661. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Shell File Write by GUARDIANWALL MailSuite Web Service
id: c64ce01a-3821-5df3-be1f-8e7a4973d595
status: experimental
description: Detects the GUARDIANWALL MailSuite web service process writing script
or executable files into its own installation or web-accessible directories, a common
post-exploitation step for dropping a web shell after successful buffer overflow
exploitation.
references:
- JPCERT/CC advisory on GUARDIANWALL MailSuite CVE-2026-32661
author: Vorant
tags:
- attack.t1190
- attack.t1203
logsource:
category: file_event
product: windows
detection:
selection:
Image|contains:
- guardianwall
- mailsuite
TargetFilename|endswith:
- .jsp
- .php
- .asp
- .aspx
- .exe
- .dll
- .ps1
- .bat
filter:
TargetFilename|contains:
- \Maintenance\
- \Update\
condition: selection and not filter
falsepositives:
- Legitimate patch installation or software update writing new binaries to the install
directory
- Vendor-signed maintenance scripts placed during scheduled updates
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2026/20260513-jvn.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free