CVE-2026-48132 Details

A denial-of-service vulnerability has been identified in Check Point Security Gateways and Spark Firewall. The issue arises because the Security Gateway improperly validates length values in certain IKE packets when NAT-T is used over UDP port 4500. This flaw allows a specially crafted or malformed packet to disrupt the VPN processing service, causing it to terminate unexpectedly. As a result, there is a temporary interruption in VPN negotiations and traffic.

To address this vulnerability, users can enable the IPS protection 'IKE Improper Length Validation' in Protection mode. For Security Gateways, the fix is included in the Jumbo Hotfix Accumulator for R82.10 starting from Take 19, for R82 starting from Take 103, and for R81.20 starting from Take 141. For Spark Firewalls, the fix is available in R81.10.17 and R82.00.10.