EUVD-2026-31819
GHSA-3h9p-9pvw-73vm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-exposed Check Point gateway with UDP/4500 open
-
DeliveryCraft malformed IKE NAT-T packet with invalid length field
-
ExploitSend packet to gateway VPN service
-
ExecutionTrigger out-of-bounds read in IKE parser
-
PersistVPN processing service crashes
-
ImpactVPN tunnels and negotiations disrupted
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target Check Point Quantum Security Gateway must have IKE with NAT Traversal (NAT-T) enabled and UDP port 4500 reachable from the attacker - the standard configuration for any deployment supporting remote-access VPN clients or site-to-site peers behind NAT. The gateway must be running an affected version: R81.10 or earlier, R81.20 at Jumbo Hotfix Take 127 or below, R82 at Take 91 or below, or R82.10 at Take 19 or below. No authentication, credentials, or user interaction are required (PR:N/UI:N). Exploitation is limited by AC:H - the attacker must craft a precisely malformed IKE length field to trigger the out-of-bounds read - and impact is bounded to denial of service of the VPN processing service rather than full appliance compromise. |
| Impact | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) rates this 8.1 High with network reach, no authentication, and high impact across CIA - however, the description only substantiates an availability impact (DoS via service crash), so the C:H/I:H components appear inconsistent with the stated effect and should be verified with Check Point. EPSS is very low (0.06%, 17th percentile) and the vulnerability is not on the CISA KEV list, indicating no observed active exploitation. AC:H (high attack complexity) further constrains real-world exploitability, as the attacker must construct a precise malformed IKE packet under specific NAT-T conditions. Net assessment: this is a meaningful availability risk for internet-exposed Check Point gateways where VPN uptime is critical, but it does not warrant emergency response in environments where patching can be scheduled - prioritize ahead of routine maintenance windows rather than as a zero-day fire drill. |
| Exploit ScenarioDerived | An attacker on the internet sends a malformed IKE packet with a manipulated length field to UDP/4500 on a Check Point gateway that has NAT-T enabled (the default for remote-access and many site-to-site deployments). The VPN processing service performs an out-of-bounds read on the malformed length and terminates, dropping active IKE/IPsec negotiations and blocking new VPN tunnel establishment until the service recovers; repeated packets sustain the outage. No authentication is required and no user interaction is involved, though AC:H suggests crafting the exact triggering packet is non-trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Denial of service in Check Point Quantum Security Gateway allows remote unauthenticated attackers to crash the VPN processing service by sending specially crafted IKE packets over NAT-T (UDP/4500). Multiple supported releases (R81.10 and below, R81.20, R82, R82.10) are affected up to specific Jumbo Hotfix takes. No public exploit identified at time of analysis, and EPSS is low at 0.06% (17th percentile), suggesting limited near-term exploitation likelihood despite the 8.1 CVSS score.
RemediationAI
Patch available per vendor advisory - install the next Jumbo Hotfix Accumulator for your branch as published in Check Point sk184982 (https://support.checkpoint.com/results/sk/sk184982), specifically a take higher than R81.20 Take 127, R82 Take 91, or R82.10 Take 19, and upgrade R81.10 (and earlier) to a supported, patched branch since all R81.10 releases are listed as affected. If patching cannot be performed immediately, compensating controls include restricting UDP/4500 (NAT-T) ingress on the gateway to known VPN peer IP addresses via an upstream firewall ACL - note that this breaks roaming/mobile VPN clients whose source IPs are unpredictable - or temporarily disabling NAT-T where peer topology permits, which will break IKE for any client behind NAT and is generally not viable for remote-access VPN deployments. Monitor the VPN daemon for unexpected restarts as a detection signal until the patch is applied.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the IKE (Internet Key Exchange) packet processing path of the Quantum Security Gateway's VPN service when NAT Traversal (NAT-T) is in use, which encapsulates IKE traffic in UDP/4500 to support clients behind NAT devices. The root cause is CWE-125 (Out-of-bounds Read): a length field within an IKE packet is not properly validated, causing the parser to read beyond the bounds of an allocated buffer when handling a malformed or attacker-crafted value. CPE data (cpe:2.3:a:checkpoint:quantum_security_gateway) confirms the vulnerability is in Check Point's enterprise VPN/firewall appliance software. While the tags include 'Information Disclosure' and 'Buffer Overflow,' the description and CWE-125 indicate the observed effect is service termination rather than memory exfiltration or code execution.
Know when Checkpoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (checkpoint) · only source for this CVE.
CVSS VectorVendor: checkpoint
Lifecycle Timeline
1DescriptionCVE.org
The Security Gateway does not correctly validate a length value in certain IKE packets when NAT-T is used (4500/UDP). As a result, a specially crafted or malformed packet can cause the VPN processing service to terminate unexpectedly, leading to denial of service (temporary interruption of VPN negotiations/traffic).
Executive ViewAI
Check Point Quantum Security Gateway contains a denial-of-service vulnerability affecting VPN gateway availability across R81.10 through R82.10 releases. Remote attackers can crash the VPN processing service via malicious IKE packets, potentially disabling remote access organization-wide; no public exploit has been identified at time of analysis. With no vendor patch currently available, immediate compensating controls are required to prevent service disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement rate limiting on UDP/4500 (IKE/NAT-T) at upstream network boundary to reduce DoS impact; (2) Configure gateway ACLs to restrict IKE access to known legitimate peer IP addresses; (3) Enable VPN gateway logging and monitoring for abnormal IKE packet patterns; (4) Maintain backup VPN failover capability to provide continuity if primary gateway is compromised.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Exploit-DB