CVE-2026-48131 - VPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero

Please read this important update from Check Point.

Security Alert:

High

Product: Security Gateways, Spark Firewall
Version: R77.20 (EOS), R77.30 (EOS), R80.10 (EOS), R80.20 (EOS), R80.20.X (EOS), R80.30 (EOS), R80.40 (EOS), R81 (EOS), R81.10 (EOS), R81.10.X, R81.20, R82, R82.00.X, R82.10
Last Modified: 2026-06-11

Symptoms

• The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early stage of a connection attempt. This can cause the service to terminate unexpectedly, resulting in denial of service (temporary disruption of VPN-related functionality).

• The VPN service is monitored by a Check Point WatchDog service and is automatically restarted.

• Existing IPsec tunnels continue to function.

• This issue affects:

• R82.10 with Jumbo Hotfix Take 6 or below

  • R82 with Jumbo Hotfix Take 91 or below
  • R81.20 with Jumbo Hotfix Take 127 or below
  • All releases from R81.10 and below

• This issue received the ID CVE-2026-48131.

Solution

Mitigations:

• If VPN services are not needed, disable the VPN feature in the Security Gateway's properties and install the policy.

To do so:

1. In the SmartConsole, open the Security Gateway object
2. In the General Properties window, clear the IPSec VPN checkbox
3. Click OK, then save and install the Security Policy

This will prevent malicious packets from reaching ports 500/UDP and 4500/UDP.

• If you want to use the VPN services, enable the IPS protection IKE Unsigned Underflow in Protection mode.

To do so:

1. In the SmartConsole, go to Security Policies > Threat Prevention
2. In Custom Policy Tools at the bottom, click IPS Protection
3. Search for IKE Unsigned Underflow
4. Double-click it to open
5. Edit Action to make sure it is set to Prevent:

Solution

For Security Gateways, the fix is included in:

• Jumbo Hotfix Accumulator for R82.10 starting from Take 19
• Jumbo Hotfix Accumulator for R82 starting from Take 103
• Jumbo Hotfix Accumulator for R81.20 starting from Take 141
• Jumbo Hotfix Accumulator for R81.10 starting from Take 187

For Spark Firewalls, see:

• R81.10.17 - sk183153
• R82.00.10 - sk184357