Check Point VPND IKE Fragment Reassembly Heap Out-of-Bounds Write (CVE-2026-48131)

Vulnerability Overview Vulnerability Name: CVE-2026-48131 - VPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero Description: The VPN service may unexpectedly terminate when processing unexpected IKE fragment values received on IKE port 500/UDP, leading to a denial of service (temporary interruption of VPN-related functions). Monitoring and Recovery: The VPN service is monitored by the Check Point WatchDog service and automatically restarts. Impact Scope Affected Products: - Security Gateways: R77.20 (E0S), R77.30 (E0S), R80.10 (E0S), R80.20 (E0S), R80.20 X (E0S), R80.30 (E0S), R80.40 (E0S), R81 (E0S), R81.10 (E0S), R81.10.X, R81.20, R82, R82.00.X, R82.10 - Spark Firewall: R82.10 Affected Versions: - R82.10 with Jumbo Hotfix Take 6 or below - R82 with Jumbo Hotfix Take 91 or below - R81.20 with Jumbo Hotfix Take 127 or below - All releases from R81.10 and below Remediation Mitigation: - Enable the IPS protection "IKE Unsigned Underflow" in Protection mode. - Steps: 1. In SmartConsole, navigate to Security Policies > Threat Prevention. 2. At the bottom of Custom Policy Tools, click IPS Protection. 3. Search for "IKE Unsigned Underflow". 4. Double-click to open. 5. Edit Actions and ensure it is set to Prevent. Specific Fix Versions: - Security Gateways: - Jumbo Hotfix Accumulator for R82.10 starting from Take 19 - Jumbo Hotfix Accumulator for R82 starting from Take 103 - Jumbo Hotfix Accumulator for R81.20 starting from Take 141 - Spark Firewalls: - R81.10.17 - sk183153 - R82.00.10 - sk184357 Additional Information Article Attributes: - Access Level: General - Severity: High - Status: Approved - Creation Date: 2026-05-20 - Last Modified Date: 2026-05-26 Page Footer Note If the required information is not found, contact the customer support team for assistance.

Goal Reached Thanks to every supporter — we hit 100%!

Check Point VPND IKE Fragment Reassembly Heap Out-of-Bounds Write (CVE-2026-48131)