> Source: [sk184982](https://support.checkpoint.com/results/sk/sk184982)

# sk184982 - CVE-2026-48132 - VPN service may restart unexpectedly when processing IKE traffic over NAT-T 4500/UDP

| Property | Value |
|----------|-------|
| Solution ID | sk184982 |
| Date Created | 2026-05-20 |
| Last Modified | 2026-06-11 |
| Technical Level | General |
| Products | Security Gateway, Spark Firewall (Locally Managed) |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R82.00.X, R81.10.X, R81 (EOS) |

## Symptoms

- * The Security Gateway does not correctly validate a length value in certain IKE packets when NAT-T is used (4500/UDP). As a result, a specially crafted or malformed packet can cause the VPN processing service to terminate unexpectedly, leading to denial of service (temporary interruption of VPN negotiations/traffic).
* This issue affects:  
  * R82.10 with Jumbo Hotfix Take 6 or below
  * R82 with Jumbo Hotfix Take 91 or below
  * R81.20 with Jumbo Hotfix Take 127 or below
  * All releases from R81.10 and below
* This issue received the ID [CVE-2026-48132](https://www.cve.org/CVERecord?id=CVE-2026-48132).

## Solution

**Mitigations**

* If VPN services are not needed, disable the VPN feature in the Security Gateway's properties and install the policy.   
  To do so:
  1. In the **SmartConsole** , open the **Security Gateway**object
  2. In the **General Properties** window, clear the **IPSec VPN**checkbox
  3. Click **OK**, then save and install the Security Policy

  <br />

  This will prevent malicious packets from reaching ports 500/UDP and 4500/UDP.  

  <br />

* If you want to use the VPN services, enable the IPS protection **IKE Improper Length Validation** in Protection mode.  
  To do so:
  1. In the **SmartConsole** , go to **Security Policies** \> **Threat Prevention**
  2. In **Custom Policy Tools** at the bottom, click **IPS Protection**
  3. Search for **IKE Improper Length Validation**
  4. Double-click it to open
  5. Edit **Action** to make sure it is set to **Prevent** :  

     ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk184981/prevent202605251859091.png)

<br />

<br />

**Solution**

For Security Gateways, the fix is included in:

* [Jumbo Hotfix Accumulator for R82.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm) starting from Take 19
* [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 103
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 141
* [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 187

<br />

For Spark Firewalls, see:  

* R81.10.17 - **[sk183153](https://support.checkpoint.com/results/sk/sk183153)**
* R82.00.10 - **[sk184357](https://support.checkpoint.com/results/sk/sk184357)**

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content