Quick answers
- Is CVE-2026-48131 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48131 being exploited in the wild.
- How severe is CVE-2026-48131?
- High severity, with a CVSS score of 8.1, published 26 May 2026.
- Which products and versions are affected?
- Check Point VPN Service (VPND).
- Is there a fix for CVE-2026-48131?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-48131 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-48131?
- Check whether you run Check Point VPN Service. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap-based buffer overflow (CWE-122) exists in the Check Point VPN daemon (VPND) during the reassembly of IKE fragments. The vulnerability is triggered when the service receives an unexpected IKE fragment value, specifically a sequence number of zero, on UDP port 500 during the early stages of a connection attempt. An unauthenticated remote attacker can exploit this by sending a specially crafted IKE packet, leading to an out-of-bounds write. While the primary reported impact is a service crash (Denial of Service), the underlying heap overflow could theoretically allow for broader memory corruption. The attack requires no user interaction but is categorized with high complexity, likely due to the specific timing or state requirements of the IKE negotiation phase.
Affected products
- Check Point VPN Service (VPND)
Timeline
- 2026-05-26: advisory: Initial advisory published by Check Point and NVD