CVE-2026-48131

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48131", "assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45", "state": "PUBLISHED", "assignerShortName": "checkpoint", "dateReserved": "2026-05-20T19:29:00.635Z", "datePublished": "2026-05-26T12:56:08.817Z", "dateUpdated": "2026-05-26T15:18:43.287Z"}, "containers": {"cna": {"affected": [{"product": "Quantum Security Gateway", "vendor": "checkpoint", "versions": [{"status": "affected", "version": "R82.10 with Jumbo Hotfix Take 6 or below"}, {"status": "affected", "version": "R82 with Jumbo Hotfix Take 91 or below"}, {"status": "affected", "version": "R81.20 with Jumbo Hotfix Take 127 or below"}, {"status": "affected", "version": "All releases from R81.10 and below"}]}], "title": "VPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero", "descriptions": [{"lang": "en", "value": "The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early stage of a connection attempt. This can cause the service to terminate unexpectedly, resulting in denial of service (temporary disruption of VPN-related functionality)."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45", "shortName": "checkpoint", "dateUpdated": "2026-05-26T14:15:50.325Z"}, "references": [{"url": "https://support.checkpoint.com/results/sk/sk184981"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T15:12:47.698813Z", "id": "CVE-2026-48131", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T15:18:43.287Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48131", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T15:12:47.698813Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T15:18:38.016Z"}}], "cna": {"title": "VPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "checkpoint", "product": "Quantum Security Gateway", "versions": [{"status": "affected", "version": "R82.10 with Jumbo Hotfix Take 6 or below"}, {"status": "affected", "version": "R82 with Jumbo Hotfix Take 91 or below"}, {"status": "affected", "version": "R81.20 with Jumbo Hotfix Take 127 or below"}, {"status": "affected", "version": "All releases from R81.10 and below"}]}], "references": [{"url": "https://support.checkpoint.com/results/sk/sk184981"}], "descriptions": [{"lang": "en", "value": "The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early stage of a connection attempt. This can cause the service to terminate unexpectedly, resulting in denial of service (temporary disruption of VPN-related functionality)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122: Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45", "shortName": "checkpoint", "dateUpdated": "2026-05-26T14:15:50.325Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48131", "state": "PUBLISHED", "dateUpdated": "2026-05-26T15:18:43.287Z", "dateReserved": "2026-05-20T19:29:00.635Z", "assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45", "datePublished": "2026-05-26T12:56:08.817Z", "assignerShortName": "checkpoint"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Quantum Security Gateway", "vendor": "checkpoint", "versions": [{"status": "affected", "version": "R82.10 with Jumbo Hotfix Take 6 or below"}, {"status": "affected", "version": "R82 with Jumbo Hotfix Take 91 or below"}, {"status": "affected", "version": "R81.20 with Jumbo Hotfix Take 127 or below"}, {"status": "affected", "version": "All releases from R81.10 and below"}]}], "source": "cve@checkpoint.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early stage of a connection attempt. This can cause the service to terminate unexpectedly, resulting in denial of service (temporary disruption of VPN-related functionality)."}, {"lang": "es", "value": "El servicio VPN puede manejar incorrectamente un valor de fragmento IKE inesperado recibido en el puerto IKE 500/UDP durante la etapa inicial de un intento de conexi\u00f3n. Esto puede provocar que el servicio finalice inesperadamente, lo que resulta en denegaci\u00f3n de servicio (interrupci\u00f3n temporal de la funcionalidad relacionada con la VPN)."}], "id": "CVE-2026-48131", "lastModified": "2026-07-24T11:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "cve@checkpoint.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48131", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-26T15:12:47.698813Z", "version": "2.0.3"}}]}, "published": "2026-05-26T14:16:38.407", "references": [{"source": "cve@checkpoint.com", "url": "https://support.checkpoint.com/results/sk/sk184981"}], "sourceIdentifier": "cve@checkpoint.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "cve@checkpoint.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0, R82.10 with Jumbo Hotfix Take 19 or below]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0, R82 with Jumbo Hotfix Take 91 or below]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0, R81.20 with Jumbo Hotfix Take 127 or below]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0, All releases from R81.10 and below]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Quantum Security Gateway", "source": "cna", "vendor": "checkpoint"}, "product": "quantum_security_gateway", "vendor": "checkpoint"}], "created": "2026-05-26T14:45:05.883872+00:00", "updated": "2026-10-25T19:15:16.912867+00:00", "vendors": ["checkpoint", "checkpoint$PRODUCT$quantum_security_gateway"]}