EUVD-2026-31818
GHSA-4qg4-f998-wjmm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Check Point VPN gateway
-
DeliverySend crafted IKE fragment to UDP/500
-
ExploitTrigger heap mishandling in IKE parser
-
ExecutionVPN service terminates unexpectedly
-
ImpactSite-to-site and remote-access tunnels drop
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerable code path is reached only during the early stage of an IKE connection attempt - the attacker must send a malformed IKE fragment with an unexpected value to UDP port 500 of a Check Point Quantum Security Gateway that has the IKE/VPN service enabled and reachable. Limiting factors: the CVSS attack complexity is High (AC:H), indicating the malformed fragment value must meet non-trivial conditions (likely specific length-field or sequence-state combinations) to reliably trigger the heap mishandling, and the gateway must be running one of the listed pre-Hotfix builds (R82 ≤ Take 91, R82.10 ≤ Take 19, R81.20 ≤ Take 127, or any R81.10 or earlier). No authentication, no existing IPsec association, and no user interaction are required (PR:N/UI:N). |
| Impact | Signals here pull strongly in opposite directions and must be reconciled. CVSS is 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H), implying network-reachable, unauthenticated exploitation with full CIA impact - but the description and SSVC assessment only support availability impact (service termination), so the C:H/I:H scoring appears inconsistent with stated behavior and should be verified against Check Point's advisory sk184981. CISA SSVC rates this Exploitation: none, Automatable: no, Technical Impact: partial, and EPSS is 0.02% (5th percentile); the CVE is not in CISA KEV. Net assessment: this is a moderate-priority patching item for internet-facing Check Point gateways because the IKE port is typically exposed and a crash disrupts all VPN connectivity, but the lack of code-execution evidence, high attack complexity (AC:H), absence of public PoC, and very low EPSS argue against emergency response. |
| Exploit ScenarioDerived | An attacker on the internet sends a single crafted IKE_SA_INIT or early-phase packet to UDP/500 of an exposed Check Point gateway with a malformed fragment length value, triggering a heap corruption in the IKE parser that crashes the VPN service and severs all site-to-site and remote-access tunnels. Repeating the packet after service restart yields a sustained outage of corporate VPN connectivity; no authentication, existing tunnel, or user interaction is required, though the AC:H rating suggests the malformed value must satisfy specific timing or state conditions to reliably trigger the bug. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Denial of service in Check Point Quantum Security Gateway allows remote unauthenticated attackers to terminate the VPN service by sending a malformed IKE fragment to UDP port 500 during the early phase of a connection attempt. The flaw affects multiple R81.x, R82, and R82.10 release trains running below specific Jumbo Hotfix Takes; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.02%, 5th percentile).
RemediationAI
Apply the Jumbo Hotfix Accumulator levels above the vulnerable thresholds: install Take 92 or later for R82, Take 20 or later for R82.10, and Take 128 or later for R81.20; for R81.10 and earlier, upgrade to a still-supported R81.20/R82 train and then apply the fixed Jumbo Hotfix Take, since those branches have no patched build identified in the EUVD data. Follow Check Point's authoritative guidance in sk184981 (https://support.checkpoint.com/results/sk/sk184981) for the exact installation procedure and any conditional steps. As a compensating control until patches are deployed, restrict UDP/500 (and UDP/4500 if VPN clients tolerate it) at perimeter ACLs to only the source IPs of known VPN peers or client VPN concentrators - this blocks the attack surface entirely but will break ad-hoc remote-access VPN for mobile users; alternatively, terminate site-to-site tunnels on a redundant gateway so that a crash of one IKE daemon fails over rather than causing a full outage.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Check Point Quantum Security Gateway is the vendor's enterprise firewall/VPN appliance line, and the vulnerable component is its IKE (Internet Key Exchange) daemon, which negotiates IPsec tunnels on UDP/500 (and 4500 for NAT-T). The root cause is classified as CWE-122 (heap-based buffer overflow) - vendor and aggregator tags (Buffer Overflow, Heap Overflow) indicate the IKE service mishandles the length/value field of an unexpected IKE fragment, corrupting heap memory and crashing the process. IKE fragmentation (RFC 7383) was introduced to handle large IKE_AUTH payloads over UDP without IP-layer fragmentation, and parsers that don't sanitize fragment metadata before reassembly are a known source of memory-corruption bugs in VPN gateways.
Know when Checkpoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (checkpoint) · only source for this CVE.
CVSS VectorVendor: checkpoint
DescriptionCVE.org
The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early stage of a connection attempt. This can cause the service to terminate unexpectedly, resulting in denial of service (temporary disruption of VPN-related functionality).
Executive ViewAI
Check Point Quantum Security Gateway in R81.x, R82, and R82.10 releases is vulnerable to denial-of-service attacks that could disrupt critical VPN service availability for remote operations. The flaw requires only network access and no authentication to trigger, though current exploitation probability remains extremely low.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deploy UDP port 500 rate limiting to restrict IKE fragment processing rate; (2) enforce firewall ACLs to restrict IKE initiation sources to known trusted locations; (3) implement real-time alerting on VPN service availability and unusual IKE session termination patterns; (4) maintain redundant VPN gateway architecture with failover capability to sustain service during potential DoS events. Monitor Check Point advisories for Jumbo Hotfix release and apply immediately.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Exploit-DB