Loading story…
JPCERT/CC issued alerts for stack-based buffer overflow vulnerabilities affecting Japanese enterprise mail products, including Canon Marketing Japan's GUARDIANWALL MailSuite and Active! mail. In the GUARDIANWALL case, the flaw is tracked as CVE-2026-32661 and allows unauthenticated remote code execution when an attacker sends a crafted request to the product's web service. The vendor said exploitation has already been confirmed in the on-premises edition, raising the risk for organizations that expose the service internally or externally.
Affected GUARDIANWALL MailSuite versions include 1.4.00 through 2.4.26 for the on-premises product, while the SaaS offering, GUARDIANWALL Mail Security Cloud, was remediated during maintenance on April 30, 2026. JPCERT/CC urged administrators to apply vendor patches, review systems for signs of compromise, preserve relevant logs, and continue monitoring vendor guidance for additional mitigations. The separate JPCERT/CC notice on Active! mail indicates a similar stack-based buffer overflow issue in another widely used mail platform, underscoring ongoing risk around mail infrastructure software.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
JPCERT/CC published advisory JPCERT-AT-2026-0013 warning about CVE-2026-32661 in Canon Marketing Japan's GUARDIANWALL MailSuite. It recommended applying the vendor patch, checking for compromise, preserving logs, and monitoring for further vendor guidance.
The developer confirmed that CVE-2026-32661, a stack-based buffer overflow in GUARDIANWALL MailSuite's web service, had already been exploited in the on-premises version. The flaw affects versions 1.4.00 through 2.4.26 and can enable unauthenticated remote code execution via a crafted request.
Canon Marketing Japan remediated the vulnerability in the SaaS version, GUARDIANWALL Mail Security Cloud, during scheduled maintenance. This fix preceded the public advisory for the on-premises product.
JPCERT/CC published an advisory about a stack-based buffer overflow vulnerability in Active! mail. The reference provides no further details beyond the advisory topic.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Openfind **MailGates/MailAudit** and **Sagredo qmail** were disclosed with critical remote code execution vulnerabilities that could let attackers compromise exposed mail infrastructure. **CVE-2026-6350** affects Openfind MailGates/MailAudit and is a stack-based buffer overflow (`CWE-121`) that allows an unauthenticated remote attacker to control execution flow and run arbitrary code. The flaw carries a **CVSS v3.1** score reflecting network exploitation with no privileges or user interaction and high impact across confidentiality, integrity, and availability, and was referenced in advisories published by **TWCERT/CC**. A second flaw, **CVE-2026-41113**, affects **Sagredo qmail** versions before `2026.04.07` and enables remote code execution through `tls_quit` because `qmail-remote.c` uses `popen` in the `notlshosts_auto` component, a command injection issue tracked as `CWE-78`. The vulnerability was documented with references to public research, a GitHub publications repository, the fixing commit, pull request `#42`, and the patched `v2026.04.07` release, giving defenders a clear remediation path while underscoring the risk to internet-facing email systems.
Jun 29, 2026
Researchers disclosed multiple critical vulnerabilities in the **SEPPMail Secure E-Mail Gateway** that can let attackers achieve remote code execution, read arbitrary files and emails, and maintain persistent control of the appliance. InfoGuard Labs said the exposed web UI and newer **GINA v2** interface are affected, with the most severe issues including `CVE-2026-2743`, an authenticated path traversal in the Large File Transfer component that can be chained into arbitrary file write and code execution, `CVE-2026-44128`, an unauthenticated Perl injection leading to RCE, `CVE-2026-44127`, a local file inclusion and arbitrary file deletion flaw, and `CVE-2026-7864`, an information disclosure bug exposing environment variables through a debug endpoint. The researchers described a practical takeover path in which an attacker overwrites `/etc/syslog.conf` and triggers a syslog reload via log rotation to obtain a Perl-based reverse shell, giving full control of the gateway and access to all mail traffic. They warned that the product is widely deployed, particularly in the DACH region, with thousands of internet-exposed instances visible, making the flaws a potential entry point into internal networks. SEPPMail released fixes across versions **15.0.2.1**, **15.0.3**, and **15.0.4**, while public reporting highlighted that successful exploitation could expose sensitive email content and enable long-term compromise of affected organizations.
Jun 29, 2026
A series of critical and high-severity vulnerabilities have been disclosed affecting a wide range of software products, including workflow automation tools, web applications, network devices, and desktop software. Notable issues include remote code execution (RCE) flaws in *n8n*, *Lilac-Reloaded for Nagios*, *FileZilla Client*, and *AVideo*, as well as privilege escalation vulnerabilities in products like *Versa SASE Client*, *AspEmail*, and *ActFax*. Several vulnerabilities allow unauthenticated attackers to upload arbitrary files, bypass authentication, or exploit weak session management, potentially leading to full system compromise or unauthorized access to sensitive data. Many of these vulnerabilities have public exploits available, increasing the risk of active exploitation in the wild. Vendors have released patches for several of the affected products, and administrators are strongly advised to update to the latest versions or apply recommended mitigations. The vulnerabilities span a variety of attack vectors, including buffer overflows, improper input validation, insecure file upload mechanisms, and misconfigured authentication endpoints. Organizations should prioritize patching systems exposed to the internet and review access controls to limit the impact of potential exploitation. Immediate attention is warranted for products with critical CVSS scores and those with known public exploits.
Jun 29, 2026