CVE-2026-48132 - VPN service may restart unexpectedly when processing IKE traffic over NAT-T 4500/UDP

Please read this important update from Check Point.

Security Alert:

High

Product: Security Gateways, Spark Firewall
Version: R77.20 (EOS), R77.30 (EOS), R80.10 (EOS), R80.20 (EOS), R80.20.X (EOS), R80.30 (EOS), R80.40 (EOS), R81 (EOS), R81.10 (EOS), R81.10.X, R81.20, R82, R82.00.X, R82.10
Last Modified: 2026-06-11

Symptoms

• The Security Gateway does not correctly validate a length value in certain IKE packets when NAT-T is used (4500/UDP). As a result, a specially crafted or malformed packet can cause the VPN processing service to terminate unexpectedly, leading to denial of service (temporary interruption of VPN negotiations/traffic).
• This issue affects:
  • R82.10 with Jumbo Hotfix Take 6 or below
  • R82 with Jumbo Hotfix Take 91 or below
  • R81.20 with Jumbo Hotfix Take 127 or below
  • All releases from R81.10 and below
• This issue received the ID CVE-2026-48132.

Solution

Mitigations

• If VPN services are not needed, disable the VPN feature in the Security Gateway's properties and install the policy.

To do so:

1. In the SmartConsole, open the Security Gateway object
2. In the General Properties window, clear the IPSec VPN checkbox
3. Click OK, then save and install the Security Policy

This will prevent malicious packets from reaching ports 500/UDP and 4500/UDP.

• If you want to use the VPN services, enable the IPS protection IKE Improper Length Validation in Protection mode.

To do so:

1. In the SmartConsole, go to Security Policies > Threat Prevention
2. In Custom Policy Tools at the bottom, click IPS Protection
3. Search for IKE Improper Length Validation
4. Double-click it to open
5. Edit Action to make sure it is set to Prevent:

Solution

For Security Gateways, the fix is included in:

• Jumbo Hotfix Accumulator for R82.10 starting from Take 19
• Jumbo Hotfix Accumulator for R82 starting from Take 103
• Jumbo Hotfix Accumulator for R81.20 starting from Take 141
• Jumbo Hotfix Accumulator for R81.10 starting from Take 187

For Spark Firewalls, see:

• R81.10.17 - sk183153
• R82.00.10 - sk184357

Article Properties

Access Level: General
Severity: High
Status: Approved
Date Created: 2026-05-20
Last Modified: 2026-06-11