List of All Resolved Issues and New Features in R81.20 Jumbo Hotfix Accumulator

Take 173 - Improvements and Resolved Issues

PMTR-129145

FMW-6423

PMTR-125405

PMTR-129591

PRJ-72302

ODU-4721

Automatic Updates

UPDATE: Added Take 179 of Web SmartConsole. Refer to sk170314.

PRJ-72393

ODU-4714

PRJ-71882

ODU-4664

Automatic Updates

UPDATE: Added Take 100 and Take 101 of Policy Insights Release Updates. Refer to sk183421.

ODU-4636

PRJ-72596

ODU-4882

Automatic Updates

UPDATE: Added Take 42 of CPM Doctor Release Updates. Refer to sk171505.

PRJ-72406

ODU-4612

Automatic Updates

UPDATE: Added Take 232 of OpenTelemetry Collector (CPotelcol) Release Updates. Refer to sk180522.

PRJ-72403

ODU-4619

Automatic Updates

UPDATE: Added Take 99 of OpenTelemetry CPviewExporter Release Updates. Refer to sk180521.

PRJ-71874

ODU-4643

Automatic Updates

UPDATE: Added Take 96 of HealthCheck Point (HCP) Release. Refer to sk171436.

PRJ-72412

ODU-4626

Automatic Updates

UPDATE: Added Take 156 of OpenTelemetry Agent (OtlpAgent) Release Updates. Refer to sk181615.

PRJ-72271

ODU-4728

Automatic Updates

UPDATE: Added Take 326 of CME (Cloud Management Extension) for Cloud Firewall Release Updates. Refer to sk157492.

PRJ-67334

PMTR-125404

Security Management

In a Multi-Domain Security Management Server environment, the FWM daemon at the MDS level may fail to start when TCP port 18190 is bound to more than one IP address.

PRJ-69411

PRHF-45782

Security Management

In some scenarios, upgrading a Security Management Server may fail during the database import with a "Failed to parse the upgrade data" error if the environment contains more than 32K IPS protections.

PRJ-71465

PRHF-47401

Security Management

Users may be unable to log in to a domain using the login-to-domain API command on the Multi-Domain Security Management Server. Refer to sk185248.

PRJ-65464

PRHF-42980

Logging

The CPSEMD process may unexpectedly exit when the Security Management Server is restarted.

PRJ-67934

PRHF-45055

Logging

In some scenarios, the system may not correctly report SOLR index deletion results in the run_maintenance.elg debug file.

PRJ-62331

PRHF-40738

Logging

In some scenarios, the SMARTLOG_SERVER process may unexpectedly exit and generate a core dump.

PRJ-69285

PRHF-45700

Logging

In some scenarios, the LOG_INDEXER process may crash unexpectedly when multiple log server connections are active, and one of the connections is disconnected.

PRJ-61855

PRHF-40192

Logging

In some scenarios, a redundant "CPSEMD low disk space notification" message may appear despite ample free disk space.

PRJ-68159

PRHF-44996

Security Gateway

In some scenarios, softlockups may occur during the dynamic objects update process. Refer to sk184887.

PRJ-67894

FMW-8845

Security Gateway

Optimized the shared memory management, which in some scenarios may impact CPU utilization.

PRJ-66696,

PRA-5192

PRJ-72171

PRHF-47698

Security Gateway

Websites returning large HTTP/2 response headers may fail to load when HTTPS Inspection is enabled.

PRJ-70304

PRHF-46417

Security Gateway

In some scenarios, servers sent compressed data with Content-Encoding: deflate but included an additional zlib header (starting with 78 01), while the Security Gateway expected raw deflate data without any header.

PRJ-70741

PRHF-46695

Security Gateway

Improved HTTP/2 flow-control handling to prevent the dropping of legitimate long-lived connections to AI assistant tools.

PRJ-71665

PMTR-127891

Security Gateway

VPN traffic may generate excessive debug messages containing fwhold_send_enqueue in the fwk.elg log file when traffic is held and later resumed. This is a cosmetic issue and does not affect traffic handling.

PRJ-71369

PRHF-47526

Security Gateway

Google reCAPTCHA failed to load in Firefox with HTTPS Inspection enabled. Refer to sk185265.

PRJ-58913

PRHF-36812

Security Gateway

In some scenarios, the Identity Awareness Gateway may fail to communicate with the LDAP Server. The "Couldn't create connection (err=5): Cannot assign requested address" LDAP leak disrupts authentication and ldapsearch" error is displayed. Refer to sk182952.

PRJ-58158

PRHF-37101

Identity Awareness

The identity deletion process returned an incorrect error message "HTTP 500: GENERIC_INTERNAL_ERROR ... Failed to send disassociation to PDP" even though the identity was successfully removed from the database.

PRJ-69619

PRHF-45953

IPS

Improved handling of rejected HTTP/2 cleartext (h2c) upgrade attempts to ensure connections recover gracefully and prevent inconsistent failure states.

PRJ-64263

PRHF-41806

ClusterXL

In scenarios involving asymmetric traffic, where the same connection tuple is reused frequently, connections may be dropped and flagged as "out of state". Refer to sk184181.

PRJ-62833

PRHF-41024

SecureXL

Adding SecureXL Rate Limiting rule with country codes fails on VSX. Refer to sk183992 and sk112454.

PRJ-71386

PRHF-47560

Gaia OS

Check Point Process Manager (PM daemon) fails to correctly monitor the DNSMASQ process.

PRJ-69180

PMTR-123379

Gaia OS

During a clean installation or when running cpstop/cpstart, the ROUTED daemon may crash with an assertion failure during Gaia system initialization. This occurs because the daemon incorrectly detects a configuration mismatch between the kernel and the database.

PMTR-132662

PRJ-70083

PMTR-122832

Gaia OS

Upgrading a Scalable Group in Traditional VSX or VSNext mode may fail if the Jumbo Hotfix Accumulator package is not installed on both the Security Management Server and the Scalable Group.

PRJ-70520

PRHF-46560

VPN

In some scenarios, Site-to-Site VPN tunnel against 3rd-party flaps every 2 minutes.

PRJ-71728

ODU-4584

CGNSIS-2611

Cloud Firewall

In some scenarios, Cloud Firewall Controller fails to fetch NSGroup content and may delete the group IP addresses.

PRJ-70243

PRHF-46338

Scalable Platforms

In rare scenarios, invalid site count values in Maestro dual-site Security Groups may cause cluster flapping and traffic impact.

PRJ-71213

PMTR-129898

Scalable Platforms

Contracts downloaded from the User Center by a Security Group Member may get deleted after Policy Installation because the SMO member's contract file overwrites the member's local file.

PRJ-71482

PRHF-46898

Scalable Platforms

When enabling the Maestro Fastforward feature, ARP checks may fail on non-SMO members during activation.

Take 170 - Improvements and Resolved Issues

PRJ-72485,

PMTR-132461

Security Management

UPDATE: Resolved CVE-2026-91843: Stack overflow in login process to the Security Management and Log servers. Refer to sk1000155.

PRJ-72643,

PRJ-72654,

PRJ-71403,

PMTR-131125,

PMTR-132648,

PMTR-132636

Security Management

UPDATE: Resolved CVE-2026-93616: Directory Traversal and File upload allows execution of arbitrary script on the Management Server. Refer to sk1000171.

Take 166 - New Functionality

PRJ-70075,

PMTR-129515

Security Management

NEW:Introducing the "show-ad-content" Management API, which enables the retrieval of users, groups, and machines from Active Directory.

Take 166 - Improvements and Resolved Issues

PRJ-71614,

ODU-4598,

PRJ-71130,

ODU-4470

Automatic Updates - Web SmartConsole

UPDATE: New features and improvements are released in Take 177 and Take 178 of Web SmartConsole. Refer to sk170314.

PRJ-71255,

ODU-4492

Automatic Updates - HCP

UPDATE: Added Take 95 of HealthCheck Point (HCP) Release Updates. Refer to sk171436.

PRJ-68590,

PMTR-127145

Automatic Updates - HCP

UPDATE: The HCP configuration sync verifier (the config_verify command) may incorrectly indicate a mismatch in the $FWDIR/boot/modules/fwkern.conf file due to differences in the line order between members.

PRJ-71382,

ODU-4591,

PRJ-71259,

ODU-4477

Automatic Updates - Policy Insights

UPDATE: Added Take 97 and Take 98 of Policy Insights Release Updates. Refer to sk183421.

PRJ-71266,

ODU-4463

Automatic Updates - CloudGuard Network

UPDATE: Added Take 38 of CloudGuard Controller Release Updates. Refer to sk181842.

PRJ-71264,

ODU-4484

Automatic Updates - CloudGuard Network

UPDATE: Added Take 325 of CME (Cloud Management Extension) Release Updates. Refer to sk157492.

PRJ-60266,

PRHF-38897

Gaia OS

UPDATE: Gaia Cloning Group synchronization (port 1129) now uses updated and more secure SSL/TLS versions for internal communication. Refer to sk182091.

PRJ-69074,

PRHF-45246

Gaia OS

UPDATE: Added support for passwords containing the ampersand "&" character, which previously caused failures in scheduled backup operations.

PRJ-62162,

PRHF-40230

VPN

UPDATE: Added support for treating trusted CA certificates with non-compliant attributes as valid. This includes certificates with incorrect Key Usage settings or missing Basic Constraints, based on customer-defined configurations. Refer to sk183800.

PRJ-71486,

PMTR-131442

VPN

UPDATE: Resolved CVE-2026-85102 - Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN. Refer to sk1000117.

PRJ-71552,

PMTR-131527

VPN

UPDATE: Resolved CVE-2026-85103 - ASN.1 decoding heap overflow leading to a remote code execution. Refer to sk1000118.

PRJ-70386,

PMTR-129271

Security Management

SmartConsole may display a "No communication" error message caused by a file descriptor leak in the FWMHA process after prolonged uptime.

PRJ-67754,

PRHF-44852

Security Management

Policy installation may fail when custom authentication *.ttm files are not included during policy package preparation, resulting in a "No such file or directory" error message.

PRJ-67494,

PRHF-44700

Security Management

In rare scenarios, the accumulation of large API request-status files could cause Security Management Server slowness.

PRJ-58526,

PRHF-37141

Security Management

In some scenarios, policy state directories are synced between active and standby Security Management Servers causing high disk space utilization.

PRJ-63510,

PRHF-41422

Security Management

The "mds_restore" command may not restore audit logs at the MDS level.

PRJ-67852,

PRHF-45034

Security Management

In rare scenarios, login to SmartConsole may fail due to a timeout.

PRJ-67759,

PRHF-44799

Security Management

Improved debug logging in the $FWDIR/log/cpm.elg file during upgrades of a Multi-Domain Security Management Server.

PRJ-62522,

PRHF-40980

Security Management

On a Multi-Domain Security Management Server, the "api stats-group-by-domain" command may report all requests as "unknown domain" instead of categorizing them per domain. Refer to sk183892.

PRJ-66785,

PRHF-43884

Security Management

In SmartConsole, a network object that is no longer referenced by any policy may fail to be deleted with an "object is being used" error message.

PRJ-67762,

PRHF-44772

Security Management

In rare scenarios, deleting a Secondary Security Management Server fails because it references objects that no longer exist.

PRJ-69863,

PRHF-45625

Security Management

When one administrator installs a policy, other logged-in administrators may see an "Error retrieving results" message in the Tasks window instead of the policy installation progress.

PRJ-69860,

PRHF-46038

Security Management

Administrators logging into SmartConsole with certificate authentication at the MDS level using the "\MDS" format may unexpectedly receive read-only permissions instead of the expected read-write access.

PRJ-70232,

PRHF-45998

Security Management

In some scenarios, when a Multi-Domain Security Management Server is connected to the Check Point Portal, a connectivity failure warning for the Global SmartEvent server may appear, even though Global SmartEvent servers are not supported in the Check Point Portal.

PRJ-67612,

PRHF-44583

Security Management

In a Management High Availability environment, the statuses of clusters and cluster members may be displayed incorrectly on the secondary Security Management Server.

PRJ-67413,

PMTR-125556

Security Management

The Management Rest API show-global-properties fails when there is a database inconsistency for the 'keep-hit-count-data-up-to' field.

PRJ-67811,

PMTR-126383

Security Management

Disk space on the Security Management Server may become depleted due to the excessive growth of internal PostgreSQL database tables.

PRJ-69441,

PRHF-45656

Security Management

Accelerated policy installation may be skipped if Compliance generates a high number of audit log entries between sessions.

PRJ-67775,

PMTR-126316

Security Management

Snort IPS protections are not downloaded to the local domain during Global Policy Assignment.

PRJ-69186,

PRHF-45542

Security Management

When generating a Show Changes PDF report for a workflow or session, the report could include internal system changes, such as IPS protection changes, that were not performed by the user.

PRJ-68286,

PRHF-44951

Security Management

Policy objects may fail to open in Web SmartConsole with a "Something went wrong" error message.

PRJ-70411,

PRHF-46322

Security Management

In an environment with multiple Multi-Domain Security Management (MDS) Servers, High Availability synchronization between MDSs may intermittently fail with the "NGM failed to import data" error message because of missing VSEC license objects in the secondary MDS database.

PRJ-60815,

PRHF-39436

Multi-Domain Management

When logging in to SmartUpdate on a Multi-Domain Security Management Server, domain licenses may not appear in the Domain Licenses view.

PRJ-68525,

PRHF-45066

SmartProvisioning

When running the LSMcli AddROBO command with the -S (SubstitutedNamePart) parameter, the cluster profile name suffix may not be substituted correctly.

PRJ-58114,

PMTR-129439

Logging

UPDATE: Added support for displaying the Member ID field in the Logs view through Edit Profile > Columns Profiles.

PRJ-67344,

PRHF-44310

Logging

In rare scenarios, the LOG_INDEXER process may crash unexpectedly due to improper memory handling.

PRJ-69985,

PRHF-46185

Logging

When viewing logs in the Check Point Portal, a "Query failed" error message may intermittently appear for several minutes.

PRJ-68883,

PRHF-45417

Logging

Exporting logs that contain "ampersand" in their fields to a CSV file via SmartView web application may fail with a "Failed to export" error message.

PRJ-57166,

PRHF-36102

Logging

When viewing Forensics Reports in SmartView through the Check Point Portal, non-ASCII characters may appear distorted.

PRJ-69245,

PRHF-45525

Logging

When right-clicking the "*_interface" field in the SmartView Logs web view and selecting Add as Filter, the query may fail, resulting in no logs being displayed.

PRJ-61606,

PRHF-40126

Security Gateway

Custom trap for BGP isn't working on MDPS when BGP is configured in data plane.

PRJ-47870,

PRHF-29668

Security Gateway

In rare scenarios, when processing TLS traffic and attempting to return an error page, the FWK process may crash.

PRJ-66834,

PRHF-43754

Security Gateway

In some scenarios, CPView may display an incorrect value for CPU user time. Refer to sk184722.

PRJ-67914,

PRHF-41891

Security Gateway

In some scenarios, the Security Gateway may not close connections properly when a device stops responding during an active download, leading to a gradual memory leak over time.

PRJ-67800,

PRHF-45012

Security Gateway

When a user configures NAT to convert a connection's destination IP address from unicast to multicast, the Security Gateway may transmit packets with an incorrect MAC address when SecureXL is enabled.

PRJ-69499,

PRHF-40443

Security Gateway

In some cases, an ICAP server closing the connection to an ICAP client with an RST may cause an FWK process crash.

PRJ-58566,

PRHF-26696

Security Gateway

In some cases, the Captive Portal fails to authenticate users when SAML authentication is enabled.

PRJ-64877,

SMBGWY-16234

Security Gateway

Improved connectivity for LSV peer traffic after an ISP failover.

PRJ-62559,

PRHF-40560

Security Gateway

Enhanced stability when manual edits to the fwkern.conf file result in a malformed configuration. To manage the file, it is recommended to use the -f option of the fw ctl set command, as detailed in sk26202.

Refer to sk184081.

PRJ-66264,

PRHF-43044

Security Gateway

The FWK process may restart unexpectedly due to improper handling of a connection.

PRJ-69101,

PRHF-45611

Security Gateway

The RAD daemon may unexpectedly exit on VSX Gateways.

PRJ-66555,

PRHF-43835

Security Gateway

In rare scenarios, a Security Gateway may crash when LSP (Link State Propagation) is enabled.

PRJ-66298,

PRHF-43833

Security Gateway

The FWK process may unexpectedly restart because of an incorrect integration with CPView.

PRJ-67538,

PRHF-44757

Security Gateway

In some scenarios, multicast traffic and a race condition during route lookup may lead to a crash in the Security Gateway.

PRJ-65676,

SWSCFG-654

Security Gateway

The PDPD daemon may encounter high CPU utilization when Nested Groups query method 5 (query by SIDs) is in use. Refer to sk183748.

PRJ-67416,

PMTR-124725

Security Gateway

In some scenarios, the ICAP Server may crash because of memory issues.

PRJ-71457,

PRHF-47521

Security Gateway

In some scenarios, users can connect to Mobile Access/SSL Network Extender, but do not have access to internal resources after upgrading. Refer to sk185260.

PRJ-69204,

PRHF-45101

Security Gateway

In some scenarios, Spike Detective file descriptors may remain undeleted.

PRJ-70510,

PMTR-130005

Threat Prevention

In certain scenarios, the Security Gateway may fail to apply a new GeoIP database update.

PRJ-69947,

PRHF-46128

Threat Prevention

The Anti-Virus may fail to load external IOC feeds that contain URL-type observables.

PRJ-65679,

PRHF-43309

Threat Emulation

Files without extensions were receiving a Scan Pass verdict from the ICAP server. As a result, malicious files without extensions were also assigned a Scan Pass verdict, which ultimately led to a Benign classification.

PRJ-55782,

PRHF-34201

Identity Awareness

In some scenarios, errors in rule number calculation prevented packet tagging from working.

PRJ-69215,

PRHF-39546

Identity Awareness

Improved handling of duplicate Identity Collector events on the PDP Security Gateway.

PRJ-65132,

PRHF-42745

URL Filtering

An HTTPS Inspection rule that contains a custom application whose name includes spaces or certain unsupported characters does not match during policy enforcement. Refer to sk184773.

PRJ-64167,

PMTR-118916

IPS

Enforced compliance with the HTTP RFC by requiring a "/" in the request path for non-proxy HTTP connections, except for the CONNECT and OPTIONS methods. Traffic that does not meet this requirement will be dropped if "Non-Compliant HTTP" is set to "Drop" and "Strict Request Parsing" is enabled.

PRJ-67473,

PRHF-44623

SSL Inspection

In some scenarios, a memory leak may occur in the WSTLSD process when it fails to decode a certificate.

PRJ-67476,

PRHF-44630

SSL Inspection

Certificate validation may fail for certificates containing an ASN.1 NumericString in the X.509 Subject attribute.

PRJ-66072,

PRHF-43570

SecureXL

In rare scenarios, a performance issue may occur when a policy is installed on multiple Virtual Systems simultaneously. Refer to sk184585.

PRJ-55338,

PRHF-33964

SecureXL

In some scenarios, the Security Gateway may not properly remove closed TCP connections, processed through Active Streaming, from its accelerated connections table if a new security policy was installed beforehand.

PRJ-67116,

PMTR-120253

SecureXL

In some scenarios, the VSX Gateway may experience significant latency when passing traffic between Virtual Systems through a Virtual Router.

PRJ-67268,

PMTR-125173

SecureXL

In some scenarios, the Security Gateway may restart unexpectedly when passing traffic through LightSpeed hardware acceleration interfaces with SecureXL User Mode enabled.

PRJ-70357,

PMTR-127257

SecureXL

In some scenarios, the VSX Gateway may not properly assign CPUs to a Firewall instance or SND after booting up when SecureXL User Mode is enabled.

PRJ-70343,

PRHF-46357

SecureXL

In some scenarios, VLAN tags are stripped and MAC addresses become malformed after traffic passes through the bridge. Refer to sk185101.

PRJ-67771,

PMTR-119674

SecureXL

In some scenarios, the VSX Gateway may experience poor performance when passing traffic between Virtual Systems through a Virtual Switch with SecureXL User Mode enabled.

PRJ-70927,

PRHF-46835

SecureXL

In certain scenarios, the VSX Gateway may transmit packets with incorrect MAC addresses for cleartext connections when SecureXL is enabled, specifically when these packets are sent through a Virtual Router or Virtual Switch.

PRJ-66860,

PMTR-124252

SecureXL

In some scenarios, the VSX Gateway may unexpectedly restart when passing traffic through a Virtual Switch with SecureXL User Mode enabled.

PRJ-58856,

PMTR-110610

SecureXL

Multicast routes may not update or respond correctly to changes in the network.

PRJ-69942,

PMTR-127433

SecureXL

In some scenarios, VPN packets are dropped in User Mode (UPPAK) during encryption when QoS is active.

PRJ-70273,

PRHF-45730

SecureXL

A rare scenario handling Jumbo Frames of specific sizes on Intel-based NICs may trigger a driver internal protection (MDD) error, potentially impacting performance or connectivity.

PRJ-69551,

PRHF-45732

Gaia OS

Performance improvements have been made to the VSX interface configuration process.

PRJ-70122,

PRHF-45729

Gaia OS

When syslog messages are forwarded to the Security Management Server using the set syslog cplogs on command, they may be misclassified under an incorrect blade instead of Syslog. This misclassification can make it challenging to filter, correlate, and analyze the logs effectively.

PRJ-69253,

PMTR-126101

Gaia OS

In some scenarios, the Security Gateway may fail to access interface data correctly when SecureXL User Mode is enabled.

PRJ-66701,

PRHF-43888

Gaia OS

Duplicate interface configuration entries appear in the show configuration command output. Refer to sk184759.

PRJ-66894,

PRHF-44101

Gaia OS

In some scenarios, duplicate interface entries appear in the output of the "show configuration" Clish command.

PRJ-68604,

PRHF-44741

Gaia OS

In rare scenarios, the Security Gateway may unexpectedly crash due to timer corruption.

PRJ-71372,

PRHF-47549

Gaia OS

Two-Factor Authentication (2FA) configurations are now preserved during upgrades to a newer R81.20 Jumbo version.

PRJ-68555,

PRHF-44964

Gaia OS

Two-Factor Authentication (2FA) initial setup may not be triggered via the Gaia Portal on Scalable Platforms.

PRJ-71811,

PRJ-71815

Gaia OS

PRJ-58308,

PRHF-37219

Gaia OS

The lower bottom threshold for the PCH-Vin sensor on Check Point Firewall 9700 appliances was set incorrectly.

PRJ-69940,

ROUT-2627

Routing

The ROUTED process may crash when more than 250 interfaces are configured and then deleted.

PRJ-69977,

PRHF-45943

Routing

In some scenarios where the SPT cannot be set on an entry with the Decap bit enabled, the Decap bit is now reset to ensure that incoming Register packets can be processed.

PRJ-60408,

TPDO-4412

Routing

Certain standard IPv6 addresses may have been incorrectly identified as multicast addresses.

PRJ-68693,

PRHF-45292

Traditional VSX

In rare scenarios, a crash may occur in Traditional VSX during a call to kmem_cache_alloc.

PRJ-67298,

PRHF-44576

Mobile Access

The Mobile Access Blade portal may not function properly with web applications that set HTTP cookies containing the pipe ('|') character in their values.

PRJ-65401,

PMTR-122348

VPN

Improved stability for Permanent Tunnel functionality when using Tunnel Test UDP/18234 in Maestro environments.

PRJ-70688,

PRHF-46758

VPN

Capsule Connect / VPN users are unable to log in and receive the error message "Client's configuration is not verified". Refer to sk185144.

PRJ-66854,

PRHF-44039

VPN

vpnd keeps crashing after downgrading from R81.20 JHF 122 to R81.20 JHF 120

PRJ-69266,

PRHF-45001

VPN

In some scenarios, the VPN tunnel flaps every 40 seconds when the in-kernel tunnel test is enabled.

PRJ-70125,

PMTR-128909

VPN

Added Layer Two Tunneling Protocol (L2TP) stabilization improvement.

PRJ-66900,

PMTR-123203

VPN

EDPC tunnel establishment failure after MEP failover to a new Security Gateway.

PRJ-67858,

PRHF-44977

VPN

In rare scenarios between an LSM Central Gateway and an LSM Satellite Gateway, the Route Injection Mechanism (RIM) may not function correctly.

PRJ-70104,

PMTR-128918

VPN

Improved stability in VPN tunnel monitoring workflows.

PRJ-70113,

PMTR-128876

VPN

Improved stability and robustness in VPN session message handling during connection flows.

PRJ-70045,

PMTR-128892

VPN

Enhanced stability and reliability in IKEv2 certificate handling.

PRJ-70580,

PRHF-46735

VPN

In rare scenarios, the VPND process may crash during Capsule VPN connections that use Mobile Device Management (MDM) compliance and certificate-based authentication.

PRJ-70108,

PMTR-128831

VPN

Enhanced stability in IKEv2 session establishment.

PRJ-70271,

PRHF-46350

VPN

In some scenarios with DAIP peers, VPN tunnel tests may fail, causing intermittent disruptions.

PRJ-65020,

SDWANGW-2726

SD-WAN

In some scenarios, when the Symmetric Packet Return feature is enabled and kernel debug is running, the sdw_get_isp_id_by_ifnum: kiss_ghtab_bl_get failed ... message is printed repeatedly in the debug output.

PRJ-70118,

CGNSIS-2240

Cloud Firewall

Nightly distribution may fail when no default license pool is set. The system now automatically promotes an available pool during distribution.

PRJ-70061,

PMTR-129147

Cloud Firewall

Reinstalling a Cloud Firewall central license with a regenerated signature may create a duplicate entry in the Management Server's license repository, which could prevent license distribution to managed Security Gateways. The Management Server now detects such conflicts and blocks the installation to avoid creating duplicates.

PRJ-70377,

PMTR-129571

Cloud Firewall

The vsec_lic_cli view command now marks Certificate Keys with expired contracts as (Expired) and provides warnings for Certificate Keys that require renewal.

PRJ-70186,

PMTR-130643

Scalable Platforms

Network Time Protocol (NTP) may stop functioning after an upgrade.

PRJ-70917,

PRJ-70923

Scalable Platforms

After uninstalling an upgrade, the permissions on the $SMODIR/lib directory and related libraries may become more restrictive than required. As a result, the Gaia Portal fails to load pages. Refer to sk185178.

PRJ-61934,

PMTR-108858

Scalable Platforms

In rare scenarios, a full sync may fail to occur after a reboot because the sync is triggered before the full sync request is completely registered.

Take 161 - Improvements and Resolved Issues

PRJ-71273,

PMTR-131093

Security Management

UPDATE: Resolved CVE-2026-18574 - Management Authentication Bypass. Refer to sk185222.

PRJ-71203,

PRHF-47279

Gaia OS

DNS may stop working after upgrading to R81.20 Jumbo Hotfix Accumulator Take 158. Refer to sk185210.

Take 158 - New Functionality

PRJ-67020,

PMTR-124959

Security Management

NEW: Added a new Management API command to retrieve an entire Access Control Layer (including inline layers) - "export-access-rulebase".

PRJ-69423,

PRHF-45847

Scalable Platforms

NEW: Added a configuration option for Maestro Orchestrator to forward Spanning Tree Protocol (STP) BPDUs to Maestro Security Group Members. Refer to sk185110.

Take 158 - Improvements and Resolved Issues

PRJ-70599,

PMTR-129991

Gaia OS

UPDATE: Resolved CVE-2026-62145 - Local privilege escalation in Gaia Portal. Refer to sk185153.

PRJ-70486,

PMTR-129956

Security Management

UPDATE: Resolved CVE-2026-62144 - Management Authentication Bypass and Privilege Escalation. Refer to sk185152.

PRJ-70934,

PMTR-130686

Security Management

UPDATE: Resolved CVE-2026-16232 - Authentication bypass with SmartConsole login process using application token. Refer to sk185169.

This Jumbo Hotfix Accumulator Take provides additional Management and Gateway hardening fixes, including VPN Site to Site and Remote Access.

PRJ-69641,

ODU-4190

Automatic Updates - Security Management

UPDATE: Added Take 89 and Take 90 of the AutoUpdater Utility. Refer to sk165653.

PRJ-69417,

ODU-4204,

PRJ-70010,

ODU-4253,

PRJ-70565,

ODU-4316

Automatic Updates - Web SmartConsole

UPDATE: New features and improvements are released in Take 171, Take 173, and Take 176 of Web SmartConsole. Refer to sk170314.

PRJ-69644,

ODU-4086,

PRJ-70602,

ODU-4337

Automatic Updates - Log Exporter

UPDATE: Added Take 65 and Take 70 of Log Exporter Auto Update Deployment. Refer to sk182866.

PRJ-69638,

ODU-4225,

PRJ-66381,

ODU-3435,

PRJ-70663,

ODU-4330

Automatic Updates - Policy Insights

UPDATE: Added Take 80, Take 82, Take 87, Take 94, and Take 96 of Policy Insights Release Updates. Refer to sk183421

PRJ-69587,

ODU-4093

Automatic Updates - Smart-1 Cloud

UPDATE: Added Take 13 and Take 75 of Smart-1 Cloud MaaS Tunnel. Refer to sk166056.

PRJ-69572,

ODU-4218

Automatic Updates - HCP

UPDATE: Added Update 28 of HealthCheck Point (HCP) Release. Refer to sk171436

PRJ-70143,

ODU-4232,

PRJ-69583,

ODU-4169

Automatic Updates - CPView

UPDATE: Added Take 57 and Take 59 of CPquid (QUID) Release Updates. Refer to sk181458.

PRJ-65594,

HEC-1347

Automatic Updates - HCP

UPDATE: Added a new HCP test that analyzes load balancing and NAT utilization, and suggests optimal distribution adjustments accordingly. Refer to sk171436.

PRJ-70685,

ODU-4351

Automatic Updates - HCP

UPDATE: Added Take 94 of HealthCheck Point (HCP) Release. Refer to sk171436

PRJ-68746,

ODU-4030

Automatic Updates - Threat Prevention

UPDATE: Added Update 28 of Autonomous Threat Prevention Management Integration Release. Refer to sk167109.

PRJ-67356,

PRHF-43660

Security Management

UPDATE: JRE is updated from version 8.0_8.50 to version 8.0_8.60.

PRJ-62060,

PMTR-111171

Security Management

UPDATE: In environments with hundreds of Updatable Objects, policy installation time has been significantly improved.

PRJ-57222,

PRHF-36163

CPView

UPDATE: On the Exporter Rates tab in CPView, the Log Exporter configuration name length limit is now increased from 15 characters to 25 characters. This resolves the issue when the configuration name may appear blank if it exceeds the length limit.

PRJ-65492,

PMTR-122413

Logging

UPDATE: SmartEvent now supports the "system alert" log type for URL Filtering and Application Control Software Blades.

PRJ-68501,

PMTR-127051

Logging

UPDATE: In the Logs view, search performance is improved when the search term includes a Cluster.

PRJ-65349,

PMTR-118923

Security Gateway

UPDATE: Added the ability to automatically stop kernel debugging after a specified number of seconds. See the R81.20 Security Gateway Administration Guide. Refer to the command "fw ctl debug -T <Number of Seconds>".

PRJ-67792,

PRHF-44615

Security Gateway

UPDATE: Optimized Mobile Access policy installation to improve performance in environments with a large Mobile Access Rule Base (more than 500 rules).

PRJ-65588,

PRHF-42963

Security Gateway

UPDATE: In environments with thousands of Domain objects or External User Groups, the policy installation duration has been significantly improved.

PRJ-66948,

PRHF-44085

Security Gateway

UPDATE: Added the "tap_mode" parameter to a dispatcher (fwmultik_dispatcher_in_tap_mode). This parameter puts the multi-core dispatcher into the Tap Mode for inbound traffic. Refer to sk184455.

PRJ-60907,

PRHF-39442

SSL Inspection

UPDATE: Added support for the X.509v3 Subject Key Identifier (SKI) and Authority Key Identifier (AKI) extensions in the HTTPS outbound inspection Certificate Authority (CA). Refer to sk184273.

PRJ-67381,

PMTR-125446

Mobile Access

UPDATE: Resolved the Mobile Access Portal XSS vulnerability in the PHP file.

PRJ-66694,

PMTR-124314

Mobile Access

UPDATE: The Magnific Popup JavaScript library is upgraded from the 1.1.0 version to 1.2.0.

PRJ-68782,

PMTR-127386

Gaia OS

UPDATE: Gaia API updates are now included in the Jumbo Hotfix Accumulator (previously were installed by AutoUpdater). See sk143612.

PRJ-63808,

PRJ-65094

Cloud Firewall

UPDATE: Azure VM sizes v2 and v3 are no longer supported. During installation of Jumbo Hotfix Accumulator or in-place upgrade, this message is now displayed: "The Azure VM size {VMsize} is deprecated for upgrade. Refer to sk183693 for details"

PRJ-67527,

PMTR-125744

Scalable Platforms

UPDATE: Old SVMAC feature is now deprecated ("toggle_same_vmac" parameter is blocked).

Only use the new SVMAC feature ("toggle_same_vmac_os").

Refer to sk165674.

PRJ-64981,

PMTR-121665

Scalable Platforms

UPDATE: Improved warning message, user confirmation prompt, and audit logging when running the "set fcd revert" command in gClish on a Scalable Platform Security Group.

PRJ-62352,

PRHF-37359

Scalable Platforms

UPDATE Global parameter "fwha_grade_should_consider_lacp" is now disabled by default.

PRJ-66879,

PMTR-117271

Scalable Platforms

UPDATE: Change in "asg monitor" and "ast stat -v" commands: when there is a grade difference between sites, manual site failover is now blocked, and a warning is displayed.

PRJ-60553,

PRHF-30495

Scalable Platforms

UPDATE: "asg_route" tests is now removed from the "asg_diag" command options.

PRJ-61156,

PRHF-39669

Diagnostics

When the "Same VMAC" feature is enabled, concurrent connections are not updated during site failover.

PRJ-60389,

PRHF-39002

CPView

In the VLAN interface, CPView shows the speed of the parent.

PRJ-67371,

PRHF-44242

CPView

CPU information may not be displayed in the CPU tab in CPView for an environment with Virtual Systems.

PRJ-68532,

PRHF-45122

Security Management

In rare scenarios, the FWM process on the Multi-Domain Security Management Server may not stop after running mdsstop.

PRJ-66178,

PRHF-43671

Security Management

In some scenarios, accumulated open sessions can cause the Security Management Server to become unavailable.

PRJ-55499,

PRHF-34095

Security Management

The delay may be observed during the "compiling policy" and "generating policy files" stages in SmartConsole.

PRJ-65206,

PRHF-42646

Security Management

API login to the Security Management Server may fail with a "Null Pointer Exception" error when the session name, comment, or description is specified.

PRJ-61548,

PRJ-62108

Security Management

In some scenarios, the automatic update of Data Center assets fails. Refer to sk184316

PRJ-60902,

PRHF-39412

Security Management

In some scenarios, when attempting to view a revision in SmartConsole, it unexpectedly crashes after several minutes with the error message: "SmartConsole has experienced a serious problem and needs to relaunch."

PRJ-67190,

PMTR-124870

Security Management

In some scenarios, after the FWM process crashes and generates a core dump, High Availability synchronization may fail, and the Security Management Servers may appear as disconnected.

PRJ-68292,

PRHF-45027

Security Management

SmartTasks may fail to send email notifications with a "send mail to <email address> failed" error when the Cc field is populated

PRJ-64521,

PRHF-42149,

PRJ-64524,

PRHF-42412

Security Management

In some scenarios, opening a Security Gateway object in SmartConsole fails with "Smart Dashboard component failed to connect to a server".

PRJ-63496,

PRHF-41612

Security Management

Policy installation may fail with "failed to get tls rulebases from policy id".

PRJ-63493,

PRHF-41691

Security Management

If the "Revert to Revision" operation fails:

• Login to the Security Management Server may fail with timeout.

• Publish operations may take a long time.

PRJ-66976,

PRHF-44315

Security Management

The FWM process may exit because of memory exhaustion and generate large core files (up to 4GB).

PRJ-66030,

PRHF-43621

Security Management

In some scenarios, the Security Management Server may generate excessive log messages, causing the $FWDIR/log/cpm.elg log file to reach its size limit quickly.

PRJ-66224,

PRHF-43824

Security Management

Packet mode search does not return results for Inline Layer rules in SmartConsole and Management API. Refer to sk184638.

PRJ-65777,

PRHF-43423

Security Management

In rare scenarios, some Management API commands may fail with "Management server failed to execute command" error.

PRJ-63909,

PRHF-41943

Security Management

In some scenarios, the Management API command "show-tasks" shows incorrect results when the "from-date" and "to-date" parameters are used. Refer to sk184072.

PRJ-64044,

PRHF-42109

Security Management

In some scenarios, running the "api stats -calc_avg_duration" command on the Security Management Server fails with the "IndexError: list index out of range" error. Refer to sk184144.

PRJ-64100,

PRHF-42074,

PRJ-66378,

PRHF-43925

Security Management

In rare scenarios, the Security Management Server fails to start after performing a "Revert to Revision" operation.

PRJ-65161,

PRHF-42879

Security Management

In SmartTask-generated emails, the Sender field displays the username instead of the user's email address.

PRJ-63532,

PRHF-41677

Security Management

Rulebase search for a specific user may fail to return rules that include user groups in which the user is a member.

PRJ-69130,

PMTR-127809

Security Management

In some scenarios, the FWM process on the Security Management Server may unexpectedly exit when performing the "Fetch branches" action in the LDAP Account Unit properties window of SmartConsole.

PRJ-66973,

PRHF-44216

Security Management

A SmartTask configured to send an email after policy installation may fail when the target gateway is a VSX object.

PRJ-66867,

PRHF-44037

Security Management

SmartConsole may display the error "the user already exists" when attempting to create a new administrator with the same name as a previously deleted SAML (Identity Provider) administrator.

PRJ-66324,

PRHF-43883

Security Management

In some scenarios, an API key may become invalid after editing an administrator account.

PRJ-66605,

PMTR-124200

Security Management

If the MGMTCOMP-DIFF-REPORT-CLIENT process becomes suspended on the Security Management Server, the Server-side Change Report Generator fails to generate and send reports when processing a large number of changes.

PRJ-65007,

PRHF-42618

Security Management

In some scenarios, the submit-time field in emails generated by SmartTask displays an incorrect value.

PRJ-65035,

PRHF-42720

Security Management

In some scenarios, the status of a Security Gateway is incorrectly displayed in the Gateways & Servers View.

PRJ-65046,

PRJ-65041

Security Management

When connecting a Domain to the Check Point Portal, Dedicated Log Servers in the Domain may not be automatically connected.

PRJ-63570,

PRHF-41727

Security Management

The Security Management Server upgrade may fail during the export phase with the "Object not found - Entities can not be found" message.

PRJ-65446,

PRHF-43029

Security Management

In some scenarios, Global Domain assignment may fail with the "Failed to save the access policy assignment properties" error.

PRJ-66945,

PRHF-44222

Security Management

SmartWorkflow may incorrectly show zero changes for a session, preventing the change report from being displayed. Refer to sk184779.

PRJ-65669,

PRHF-43067

Security Management

In some scenarios, the Domain Log Management Server fails to connect to the Check Point Portal.

PRJ-61278,

PRHF-39745

Security Management

In some scenarios, the Management API command "show-simple-clusters" with "details-level full" may fail with the error message "Configuration Sharing Failed to update Check Point Portal".

PRJ-61280,

PRHF-38623

Security Management

In rare scenarios, the /var/tmp directory may be filled up with redundant tmpUserDefineCmd_OS0*.sh files, created during Compliance Software Blade scans.

PRJ-61771,

PRHF-40047

Security Management

Security Gateway license information may not be visible in SmartConsole when using Demo mode or when connecting with a read-only user.

PRJ-59613,

PRHF-38392

Security Management

Upon creation of a new Domain on a Multi-Domain Security Management Server, the Domain Server's virtual IP address is not added to the Gaia database, making it inaccessible via Clish commands. Refer to sk183941.

PRJ-68994,

PMTR-127578

AIOps

A temporary fix related to the QUID identity database (used by CPDiag and AIOps) caused issues in Maestro environments and led to degradation and occasional agent resets in AIOps, as it relies on this component as its IdentityDB. The fix has therefore been removed.

PRJ-56715,

PRHF-35509

Logging

In the Connection logs, the Source Country and Destination Country fields may contain missing or incorrect values.

PRJ-59832,

PRHF-38494

Logging

In HTTPS Inspection logs, some log entries may incorrectly display "Log Update" in the Software Blade field.

PRJ-64073,

SL-9462

Logging

In some scenarios, incorrect values are shown in the "Total Bytes" field in the logs. Refer to sk184237.

PRJ-66841,

PRHF-44182

Logging

In some scenarios, non-ASCII characters may appear garbled in SmartEvent Automatic Reaction emails.

PRJ-66530,

PRHF-44001

Logging

CPView may display "N/A" values for logging-related metrics when there is insufficient free disk space in the log partition.

PRJ-63013,

PRHF-41211

Logging

In some scenarios, the SmartLog Server process may unexpectedly exit and generate a core dump.

PRJ-66903,

PRHF-44038

Logging

High load on the LOG_INDEXER process may impact system performance.

PRJ-66321,

PMTR-123346

Logging

In some scenarios, the LOG_INDEXER process unexpectedly exits and generates a core dump.

PRJ-66656,

PRHF-41752

Logging

In SmartConsole, when exporting logs from the Logs tab to a CSV file, the "Rule" column may display only the parent rule number instead of the specific inline rule number.

PRJ-65331,

PRHF-42927

Logging

In SmartView Monitor, opened from the Logs & Events > Tunnel & User Monitoring view, the "SmartEvent Correlation Unit" status may be displayed as "Not running" although the CPSEMD process is running.

PRJ-63440,

PRHF-39816

Logging

In a Management High Availability environment, configuring threshold settings in SmartView Monitor, fails with the "Couldn't load threshold settings for the selected gateway" error.

PRJ-65905,

PMTR-121592

Logging

In the "HTTPS Inspection Statistics" in SmartView, filtering by the "bypass_reason" field returns no results.

PRJ-60250,

PRHF-36152

Logging

SmartEvent processes may unexpectedly exit in environments containing over 1 million network objects.

PRJ-68593,

PRHF-45113

Security Gateway

In a rare scenario, the FWK process crashes when the Mirror and Decrypt feature handles large MTU frames.

PRJ-62434,

PRHF-40579

Security Gateway

FTP traffic does not pass through Security Gateway when using the FTP Extended Passive Mode. Refer to sk183853.

PRJ-64833,

PRHF-42537

Security Gateway

Legitimate files may be incorrectly flagged as malicious when scanned with ICAP. Refer to sk184628.

PRJ-57232,

PRHF-29611

Security Gateway

In a rare scenario, the CPD process may crash because of a race condition.

PRJ-62968,

PRHF-41301

Security Gateway

In rare scenarios, when deleting a subordinate interface from a bonding group, the FWK process may exit. Refer to sk183736.

PRJ-65663,

PRHF-43354

Security Gateway

There may be high CPU usage by the CMID process when the ICAP Client is enabled on Security Gateway. Refer to sk184524.

PRJ-66747,

PRHF-44002

Security Gateway

When ISP Redundancy is enabled, and the administrator changes the priority, the primary ISP may not be updated in the Security Gateway (the route is updated, but the Security Gateway continues to consider the old ISP as the primary/standby). Refer to sk184923.

PRJ-68165,

PMTR-113101

Security Gateway

Policy installation may fail because of empty settings in Suspicious Activity Monitoring (SAM) rules.

PRJ-60595,

FMW-2291

Security Gateway

In cluster configurations, synchronization between members was optimized to reduce CPU overhead.

PRJ-62366,

PMTR-116380

Security Gateway

On 9400, 9700, and 9800 Check Point Firewall Appliances, the throughput is blocked up to ~2.5G for IPv6 tests.

PRJ-64518,

PRHF-41790

Security Gateway

First packet may be delayed for around 10 seconds because of pending WSDNSD DNS lookup over TCP. Refer to sk184096.

PRJ-64161,

PRHF-42100

Security Gateway

In rare scenarios, ElasticXL VSX Cluster Members fail over several times per day because of HTTP/2 explicit proxy process termination. Refer to sk184932.

PRJ-65228,

PRHF-42920

Security Gateway

Active Streaming Layer connections become stuck, resulting in increased memory consumption over time on the Security Gateway.

PRJ-65267,

PMTR-121815

Security Gateway

In some scenarios, non-accelerated traffic from a Standby VSX Cluster member may not be routed to the correct virtual instance on the current Active member when SecureXL User Mode (UPPAK) is enabled.

PRJ-63998,

PRHF-42068

Security Gateway

Suspicious Activity Monitoring (SAM) rules may not function properly on a standalone device. Refer to sk184330.

PRJ-67079,

PRHF-44360

Security Gateway

On ClusterXL and in Maestro Security Groups, after performing a rolling upgrade that includes a change in the CoreXL instance count, newly created firewall instances may remain in local-sync-only mode. As a result, these instances do not receive state updates from their peers, leading to intermittent connection failures and "First packet isn't SYN" drops. Refer to sk184786.

PRJ-67745,

PMTR-125710

Security Gateway

In a rare scenario, the FWD daemon may restart because of the Application Control Dynamic URL List version file.

PRJ-67646,

PRHF-44347

Security Gateway

In some scenarios, internal memory mishandling in global connections may cause unexpected behavior or connectivity issues.

PRJ-67155,

PRHF-44365

Security Gateway

In some scenarios related to Check Point Active Streaming (CPAS), the Security Gateway may unexpectedly crash.

PRJ-66358,

PRHF-43916

Security Gateway

The BMAC/VMAC verification for a VSX Maestro Security Group member incorrectly reports a failure on warp interfaces.

PRJ-65756,

PRHF-42940

Security Gateway

Some service ports may be missing in some instances, resulting in unexpected behavior for some services.

PRJ-65726,

PRHF-43228

Security Gateway

In some scenarios, when the Mirror and Decrypt feature is enabled, there may be traffic disruption.

PRJ-64087,

PRHF-40610

Security Gateway

The RAD daemon may unexpectedly exit when customizing RAD internal parameters ("max_flows" and "queu_max_capacity"). Refer to sk182136

PRJ-64077,

PRHF-41256

Security Gateway

In scenarios where a network connection is closed before the Anti-Virus ThreatCloud emulation or scanning response is received, the affected session may experience connectivity instability.

PRJ-64055,

PRHF-42098

Security Gateway

In rare scenarios, the FWK process may unexpectedly restart when an HTTP/2 connection containing specific stream characteristics is released.

PRJ-66620,

PRHF-44062

Security Gateway

In rare cases, the FWK process may restart unexpectedly while the Security Gateway is processing a URL Filtering categorization response and a policy installation is running simultaneously.

PRJ-66488,

PRHF-43994

Security Gateway

In a rare HTTP/2 traffic scenario, a valid connection may fail.

PRJ-65441,

PRHF-42991

Security Gateway

The SD-WAN NAT rule may not be applied when no NAT is defined in the Access Control policy.

PRJ-63681,

PRA-5002

Security Gateway

In a rare scenario, the FWD process may crash during Policy Installation because of memory corruption related to licensing.

PRJ-63658,

PRHF-41793

Security Gateway

FTP transfers of files smaller than 1KB fail and result in empty files on the destination server. Refer to sk184200.

PRJ-65521,

PRHF-42914

Security Gateway

RSH connections fail when Destination NAT is configured for the RSH server. Refer to sk184768.

PRJ-66803,

PRHF-44149

Security Gateway

In rare scenarios, the FWK process may unexpectedly exit when the Anti-Bot Software Blade inspects a specific malformed domain.

PRJ-66419,

PRHF-43935

Security Gateway

In a rare scenario, a memory leak may occur due to a race condition between policy installation and Application Control/IPS signature updates, and persists until the next policy installation.

PRJ-66431,

PRHF-43910

Security Gateway

The memory usage may increase over time when using the Mirror and Decrypt feature.

PRJ-66003,

PRHF-43522

Security Gateway

In a rare scenario, an incorrect zone assignment occurs when NAT Rule Base returns HOLD. Refer to sk184530.

PRJ-65977,

PRHF-43452

Security Gateway

After an upgrade, the "show configuration" command output for MDPS may be missing bond configuration.

PRJ-64913,

PRA-4998

Security Gateway

When ESP traffic is present in the environment, and the fwmultik_dispatcher_in_tap_mode parameter is enabled, the Security Gateway may drop ESP traffic.

PRJ-64755,

PRHF-38664

Security Gateway

The ICAP client does not work correctly, impacts the allowed number of characters for the ":service" field in the ICAP configuration file $FWDIR/conf/icap_client_blade_configuration.C.

PRJ-62611,

PRHF-41063

Security Gateway

In some rare scenarios, when HyperFlow is enabled, HTTPS traffic fails when processed in the accelerated pipelined path. Websites going through SSL Inspection may take a long time to load or parts of the website may not load.

PRJ-61384,

PMTR-113498

Security Gateway

In a VSX setup, when Dynamic Balancing is enabled, and an Elephant Flow is running, only one firewall instance may remain active to handle the rest of the traffic.

PRJ-64845,

PMTR-120708

Security Gateway

HTTPS inspection causes connections to fail when using a custom service with a non-standard HTTPS port (for example, TCP/9400), and the custom service object is configured with "Protocol: None". Refer to sk184294.

PRJ-63599,

PMTR-117005

Security Gateway

In some scenarios, DOS/Rate Limiting causes blocking errors during boot.

PRJ-63725,

PMTR-94556

Security Gateway

Connections handled by CPAS may stop forwarding data upon receiving a FIN from one side. As a result, a file download fails.

PRJ-60247,

PMTR-113336

Security Gateway

In some scenarios, active connections using HyperFlow are closed following a crash of the dmd_run process, and the FWK process may also crash. This error appears in the dmd.elg file: "mux_dmd_handle_errors_from_dmd: Handling errors from DMD. error SESSION_COLLISION".

PRJ-58537,

PRHF-37274

Threat Prevention

SSH connections may fail after enabling SSH Deep Packet Inspection (DPI).

PRJ-69301,

PMTR-124700

Threat Prevention

In some scenarios, Zero Phishing becomes inactive during traffic inspection when Anti-Virus performs a Deep Scan on HTML or JavaScript files.

PRJ-68771,

PMTR-127315

Threat Prevention

IoC feed observables may continue to be enforced even after Anti-Virus and Anti-Bot are disabled.

PRJ-66295,

PMTR-123479

Threat Prevention

In a rare scenario, the Threat Prevention rule base may fail to match traffic to any rule.

PRJ-65306,

PRHF-42982

Threat Prevention

In rare scenarios, the Anti-Virus fails to inspect HTTP file downloads.

PRJ-63419,

PMTR-114692

Threat Prevention

In certain scenarios, IP Range observables using CIDR notation within an IoC feed may not be enforced by the Gateway. Refer to sk184031.

PRJ-57712,

PRHF-36392

Identity Awareness

The Microsoft Graph API access token does not renew if an authorization error occurs while working in on-demand fetch mode.

PRJ-65631,

PRHF-42181

Identity Awareness

Identity Awareness AD user authentication takes a long time. Refer to sk183748.

PRJ-69141,

PMTR-127848

Identity Awareness

The default role in Aruba Networks ClearPass CPPM does not match the identity sessions.

PRJ-64693,

PRHF-42522

Identity Awareness

When the Packet Tagging feature is enabled on the Full Identity Agent, new user and machine identity sessions reported to the Identity Awareness Gateway may not be assigned the correct access roles. As a result, traffic from these sessions may not match Access Control Policy rules that use access roles with Packet Tagging enabled.

PRJ-64119,

PRHF-41176

Identity Awareness

In a rare scenario, there may be no access to resources for identities received from the Remote Access identity source.

PRJ-64919,

PRHF-42534

Identity Awareness

In a rare scenario, a Policy Decision Point (PDP) Security Gateway that acts as both an Identity Broker Subscriber and a sharing identity with a Policy Enforcement Point (PEP) may become unresponsive.

PRJ-59798,

PRHF-38576

Identity Awareness

SNMP queries to the Security Gateway may return unexpected results: specific IP addresses or Identity Collector objects may continue to appear in SNMP outputs even after being removed from the topology configuration. Additionally, polling OIDs such as 1.3.6.1.4.1.2620.1.38.55 or 1.3.6.1.4.1.2620.1.38.53 may result in the message "No Such Instance currently exists at this OID"

PRJ-64785,

PRHF-42302

Identity Awareness

In some scenarios, the PDPD process stops responding and users cannot authenticate through the Identity Awareness. Refer to sk184407.

PRJ-65959,

PMTR-123099

Application Control

Updating two or more Dynamic URL Lists may result in partial updates.

PRJ-66560,

PRHF-43834

Application Control

When using custom applications and SD-WAN, HTTPS traffic may be blocked with "Reason: Application Control - Internal system error" in SmartConsole log.

PRJ-65875,

PMTR-123004

Application Control

In a rare scenario, when using Dynamic URL List, updating the version file may result in a FWK process restart.

PRJ-67578,

PRHF-44375

URL Filtering

RAD request drop may occur in rare case header includes unsupported characters.

PRJ-67374,

PMTR-125272

IPS

In some scenarios, the Custom Threat Prevention policy fails to enforce IPS protection overrides on rules configured with a network group in the "Install On" column.

PRJ-59837,

PRHF-38433

DLP

In some scenarios, changes to the kernel parameter "dlpk_drv_default_queue_sz" may not take effect.

PRJ-65023,

PRHF-42722

Anti-Virus

In rare scenarios, the RAD process may exit generating a core dump.

PRJ-65578,

AAD-8717

SSL Inspection

A memory leak may occur in the parsers_is TLS module when HTTPS Inspection is enabled and used to inspect non-standard TLS traffic transmitted over a proxy.

PRJ-66593,

PRHF-44051

Mobile Access

When Mobile Access is working in Path Translation (PT) Link Translation mode, the Citrix application may not load after an upgrade to Citrix version LTSR 2507

PRJ-70252,

PMTR-129404

Mobile Access

After hardening non-RFC-compliant HTTP requests, some Mobile VPN connections fail. Since multiple clients send bare LF requests (a specific type of non-RFC-compliant traffic), bare LF errors are now disabled by default. This behavior can be enabled using the kernel parameter "ws_block_bare_lf".

PRJ-64364,

PRHF-40663

ClusterXL

Connections with fragmented packets drop on Scalable Platform/Maestro when there are multiple active Security Group Members (SGMs) on the site. Refer to sk182559.

PRJ-64089,

PRA-5003

ClusterXL

When MDPS is enabled, cluster members may remain in INIT or DOWN state after reboot.

PRJ-66292,

PRA-5197

ClusterXL

In rare scenarios, CPHASTART, CPHACONF, and CPHAMCSET processes may intermittently unexpectedly exit.

PRJ-66147,

PMTR-123186

ClusterXL

After rebooting specific Security Group Members (SGMs) in a dual-site Maestro environment, PDP (Policy Decision Point) to PEP (Policy Enforcement Point) connections are not always corrected to the SMO (Single Management Object) as expected. This results in connection restarts and additional CPU load.

PRJ-65991,

PRHF-43213

ClusterXL

In some scenarios, the USIM process may unexpectedly exit.

PRJ-59710,

PRHF-37976

ClusterXL

The "cphaconf failover_bond <bond_name>" command fails with Management Data Plane Separation (MDPS). Refer to sk183935.

PRJ-66066,

PMTR-121465

SecureXL

In a Cloud Firewall environment with Kernel Performance Pack (KPPAK) enabled by default, when modifying the TX queue size parameter for supported network interfaces to 2048 (2K) or 4096 (4K), reverting the setting back to the default value of 1024 (1K) is not possible.

The issue is observed with these synthetic network drivers: virtio (used in GCP and KVM environments), vmxnet3 (used in VMware ESXi), and ena (used in AWS).

PRJ-66601,

PMTR-117662

SecureXL

In some scenarios, a crash occurs when many concurrent nexthop lookups are performed.

PRJ-57244,

PMTR-103508

SecureXL

Added logic to forbid IP forwarding at startup if the deny list/rate limit policy installation fails.

PRJ-64487,

PMTR-120867

SecureXL

In rare scenarios, instability of the User Space Firewall during system boot may cause failures in SecureXL User Mode (UPPAK).

PRJ-64173,

PRHF-42253

SecureXL

The "arping" command on the Security Gateway returns this output "Sent 4 probes Received 0 response" in SecureXL User Mode (UPPAK). Refer to sk184292.

PRJ-64146,

PMTR-120207

SecureXL

The Security Gateway with SecureXL User Mode (UPPAK) enabled may not properly update routes when bond interfaces are configured.

PRJ-63505,

PMTR-119083

SecureXL

When VLAN interfaces are created on top of bond interfaces configured for Load Sharing, connections may not be hardware accelerated if the bond uses multiple ports from the same physical NIC. Refer to sk184291.

PRJ-67244,

PRHF-44550

SecureXL

Maestro backplane interfaces may appear in the SYN Defender interface list. This is a cosmetic issue.

PRJ-67765,

PMTR-119508

SecureXL

When using DoS Deny List and running "cpstop", an error message may be displayed, and a memory leak may occur.

PRJ-67065,

PMTR-124718

SecureXL

The FWK process may exit during an upgrade if DOS/Rate limiting is active.

PRJ-68392,

PMTR-106768

SecureXL

In some scenarios, VPN clients establish the tunnel in Visitor Mode instead of NAT-T.

PRJ-68720,

PMTR-126262

SecureXL

After rebooting the Security Gateway, the Allow List entry is present when viewing the list, but it is not enforced. The Deny List takes precedence, and traffic from the IP is blocked, even though it should be allowed according to the configuration

PRJ-66506,

PMTR-122586

SecureXL

In some scenarios in a VSX Maestro Security Group, when SecureXL User Mode (UPPAK) is enabled, a cluster member may incorrectly forward traffic through a Warp interface to the incorrect Virtual System. This results in traffic not being processed by the intended Virtual System, potentially causing "Out of State" drops.

PRJ-66211,

PMTR-123304

SecureXL

A reference count issue in the UPPAK module can cause a USIM process core dump, particularly on busy systems with long uptime.

PRJ-66170,

PRHF-43757

SecureXL

In some scenarios, when installing a policy fails, the Sand Blast Security Gateway becomes unresponsive and reboots automatically. The "Installation failed. Reason: Due to a timeout value of 600000 (millisecond) (port) (IP), Security Management Server aborted the connection with the peer" error is displayed in SmartConsole.

PRJ-65913,

PMTR-122248

SecureXL

When SecureXL User Mode (UPPAK) is enabled on a VSX Security Gateway, taking down a warp interface on any Virtual System may cause all Virtual Systems connected to the same Virtual Router or Switch to lose network connectivity.

PRJ-65450,

PMTR-121744

SecureXL

Permanently disabling the "cphwd_enable_ecmp" global parameter on a VSX Gateway using the "-f" option of the "fwl ctl set" command may fail.

PRJ-65600,

PMTR-122439

SecureXL

When SecureXL works in User Mode (UPPAK) on Security Gateways with CPAC-4-10F-C interface modules, invalid Ethernet frames permanently shut down the port's transmit queue, causing complete connectivity loss.

PRJ-65885,

PRHF-43515

SecureXL

PPTP/GRE traffic fails when Hide NAT is used and SecureXL runs in UPPAK mode and the "fw_pptp_enforce_protocol" parameter is enabled. Refer to sk184641.

PRJ-54515,

PMTR-103535

SecureXL

The USIM process may crash because of memory allocation failures.

PRJ-61885,

PRJ-61014

SecureXL

In some scenarios, an error occurs in UPPAK mode when packets are cloned. This can lead to random crashes in the USIM process, causing instability during interface changes or high traffic.

PRJ-69885,

PRJ-69330

SecureXL

In some scenarios, the VSX Security Gateway passes traffic without performing proper NAT from a Virtual Router or Switch's external interface when SecureXL User Mode is enabled.

PRJ-64012,

PMTR-119496

SecureXL

In some scenarios in UPPAK mode, the nexthops may be incorrectly indexed, which leads to packet drops.

PRJ-67172,

PRHF-44146

Routing

A ROUTED daemon may exit with a dump file during an OSPF route lookup on a route being redistributed between BGP and OSPF.

PRJ-66228,

PRHF-43674

Routing

The ROUTED daemon may exit when running the "show bgp paths" command.

PRJ-67017,

PRHF-44174

Routing

The ROUTED daemon may exit with a pnote on Security Group Members after the Orchestrator daemon (ORCHD) stops. Refer to sk184771.

PRJ-65916,

PMTR-122434

Routing

A VSX Security Gateway may drop traffic with IPv4 options or IPv6 extension headers arriving from a Virtual Switch (VSW) interface.

PRJ-67624,

PRHF-44844

VSX

When using VSX SmartProvisioning on Maestro, the operation fails if the VSX Gateway name includes the substring "wrp0".

PRJ-67113,

PMTR-123775

VSX

When adding or deleting static routes in the huge VSX environment (more than 50 Virtual Systems and hundreds of static routes), VS creation fails with "Unable to watch directory /etc/routed-mc-enable: init: Too many open files". Refer to sk181317.

PRJ-58507,

PRHF-44304

VSX

When configuring DNS addresses per-VS (different servers for different VSs), the DNS may fail.

PRJ-62321,

PMTR-116925

VSX

In some scenarios, the CPView utility causes high CPU usage or becomes stuck while calculating disk space.

PRJ-67929,

PRHF-45114

Multi-Portal

In a rare scenario, a security hardening change related to Multi-Portal connections may cause an unexpected Security Gateway restart when such a connection is terminated.

PRJ-53498,

PRHF-32832

Gaia OS

A snapshot created via the Gaia Portal is deleted immediately upon creation. Once this occurs, the operation cannot be retried. Orphaned lock files block all subsequent attempts. The error "Snapshot: Failed to take snapshot. Another backup / snapshot is currently in execution. Please try again in a few moments" is printed in the logs. Manual deletion of the lock files is required to restore functionality. Applying the workaround from sk100403 does not provide a permanent resolution, and the issue recurs.

PRJ-59153,

PRHF-37998

Gaia OS

When the nstat utility (in the iproute2 package) encounters a corrupted state file (for example, if /tmp/.nstat.u0 contains invalid data), it aborts with a core dump instead of providing an error message.

PRJ-59063,

PMTR-110978

Gaia OS

The "config_verify" command or the HCP configuration sync validation incorrectly fails because of a fwkern.conf file mismatch between the Security Group members.

PRJ-50670,

PRHF-30690

Gaia OS

Custom log rotation configured using Gaia OS does not apply to SAML-related log files, so these logs are not rotated automatically. Refer to sk113241

PRJ-56024,

PRHF-34965

Gaia OS

Custom log rotation configured using Gaia OS does not apply to UserCheck Portal log files, so these logs are not rotated automatically. Refer to sk113241.

PRJ-64588,

PRHF-41203

Gaia OS

CPU spikes may occur in a cluster when SNMP is enabled.

PRJ-67501,

PRHF-44333

Gaia OS

After an upgrade, in some scenarios, two-factor authentication (2FA) may not be enforced for SSH access. This results in users are able to authenticate via SSH without the required 2FA.

PRJ-69111,

PRHF-44815

Gaia OS

After disabling Two-factor authentication (2FA) in Gaia OS, the user still requires a 2FA code on login attempts.

PRJ-64556,

PRHF-42434

Gaia OS

Unable to enter Virtual System with "virtual-system-access all" configured. Refer to sk184282.

PRJ-66750,

PRHF-44108

Gaia OS

Cloning groups may fail during configuration updates. Refer to sk184701.

PRJ-65946,

PRHF-43616

Gaia OS

Remote and local backup operations fail after installation of Jumbo Hotfix Accumulator with the "Cannot complete the backup process: not enough space in /var/log/CPbackup/backups" error. Refer to sk183767.

PRJ-65648,

PRHF-43017

Gaia OS

Excessive log entries for RADIUS users logging into Gaia Portal. Refer to sk184534.

PRJ-66614,

PRHF-43985

Gaia OS

Newly added SGM remains "Down" on Scalable Chassis with SSM440 configured with MTU higher than 9000. Refer to sk184653.

PRJ-66407,

PRHF-43907

Gaia OS

The SNMPD daemon fails to restart when an interface configured with an IPv6 address is set as the SNMP agent interface.

PRJ-65925,

PRHF-43620

Gaia OS

Clish may restart unexpectedly when running the set snapshot-onetime command.

PRJ-65698,

PRHF-42970

Gaia OS

Chassis parameters "fwha_mbs_blade_state_events" and "fwha_mbs_interface_state_events" will not be written in the $FWDIR/boot/modules/fwkern.conf file if the values are not set, and the value is 0.

PRJ-65525,

PRHF-43016

Gaia OS

Upon logging in to the Gaia Portal, the login page accepts the credentials, briefly displays the homepage, and then automatically redirects back to the login screen.

PRJ-64773,

PRHF-42632

Gaia OS

Configuring an IPv6 NTP server (via CLI or WebUI) may cause the NTP service to ignore the server and repeatedly log errors.

PRJ-62670,

PRHF-40983

Gaia OS

Multiple "login_notifier_server: before force_2fa_generation, params: 2fa-check" messages appear in the /var/log/messages file. The issue is cosmetic. Refer to sk183690.

PRJ-69002,

PRHF-45517

Gaia OS

In Gaia Portal, bond member interfaces can be edited when they should be disabled.

PRJ-68249,

PMTR-126527

Gaia OS

For IDNS-Resolver, when the DNS server returns "TC=1", and communication should be moved to TCP instead of UDP, TCP communication does not block DNS requests.

PRJ-66883,

PRHF-43932

Gaia OS

In rare scenarios, the CORE_UPLOADER process on Security Gateways may unexpectedly generate a core dump when the number of detected CPU cores exceeds a specific threshold.

PRJ-67602,

PRHF-44603

Gaia OS

In some scenarios, SNMP monitoring may incorrectly report 100% CPU usage.

PRJ-70033,

PMTR-129280

VPN

Improved certificate validation during IKEv2 VPN negotiations to ensure VPN connections are established only after successful certificate-based authentication.

PRJ-62054,

PRHF-40518

VPN

IKE daemons may fail to start on Cluster members without generating dump files.

PRJ-64805,

PRHF-42566

VPN

Traffic passing through a route-based VPN tunnel may cause high CPU usage if the traffic is fragmented.

PRJ-68989,

PMTR-116331

VPN

Added the ability to import additional .p12 certificate types as inbound and outbound certificates.

PRJ-67351,

PMTR-125245

VPN

In VPN Site-to-Site environments, a memory leak in VPN-related processes may occur after a VPN driver restart, or during prolonged system runtime.

PRJ-69426,

PMTR-128278

VPN

Improved input validation in the VPN L2TP PPP packet parser to handle malformed configuration options correctly.

PRJ-69525,

PMTR-128338

VPN

Improved address validation in the VPN Remote Access proxy to correctly restrict outbound connections to internal and link-local destinations.

PRJ-66364,

PMTR-123613

VPN

In some scenarios, over time, prolonged VPN traffic may lead to gradual memory growth.

PRJ-70098,

PRHF-45664

VPN

In ElasticXL environments, a stale NAT-T port in the cluster sync overwrites the correct port.

PRJ-66683,

PMTR-123507

VPN

During VPN IKEv2 negotiations with third-party peers that offer multiple combined encryption algorithms (both AES-GCM-128 and AES-GCM-256), the Security Gateway may not properly match the proposal, resulting in IKE failure logs and the tunnel establishment failure.

PRJ-65825,

PRHF-43529

VPN

A customized Per-gateway Secure Configuration Verification (SCV) policy is not enforced for Remote Access VPN clients. Refer to sk184863.

PRJ-65325,

PRHF-42932

VPN

When using Capsule VPN or Endpoint Security VPN (Connect) clients in IPsec mode with IKED enabled, users can successfully authenticate and establish a VPN tunnel. However, group information received from the RADIUS server is not passed to the IKED process. As a result, security policies and access roles that rely on RADIUS group membership do not apply, and users are unable to access internal resources through the VPN.

PRJ-65320,

PRHF-42883

VPN

The VPND or IKED daemon may crash during IKEv2 negotiation.

PRJ-63828,

PRHF-41901

VPN

When generating a CPInfo file using the CPInfo utility, major CPU spikes may occur on the Security Gateway or Security Management Server.

PRJ-65666,

PMTR-119883

VPN

When Hub Mode is not enabled, traffic destined for dynamic objects included in the Remote Access VPN Split Tunneling Inclusion group may be incorrectly dropped. As a result, remote users may be unable to access resources defined by these dynamic objects, even though they are specified for inclusion in the split tunnel.

PRJ-61161,

PMTR-92656

VPN

A VPN tunnel may fail to establish in ClusterXL Load Sharing Mode during cluster member failover (pivot recovery).

PRJ-60956,

PRHF-38401

VPN

High CPU utilization on single core because of excessive VPN probing and SEP correction in ClusterXL HA Mode. Refer to sk183814.

PRJ-63551,

PRHF-41687

VPN

CRL files may not be synchronized as expected in Management High Availability and Multi-Domain Security Management environments.

PRJ-57365,

PRHF-36014

VPN

Certificate validity period not applied after using the "set_cert_validity" command. Refer to sk184230.

PRJ-62439,

PMTR-116975

VPN

Improved SSL Network Extender (SNX) certificate-based authentication stability and session reliability.

PRJ-64734,

SDWANGW-5773

SD-WAN

A VPN IPv6 traffic outage may occur when a host/network object is defined with the Security Gateway's main IPv6 address.

PRJ-68332,

AAD-9724

SD-WAN

On the Scalable Platform Cluster, LS fragmented packets may be dropped on the receiving member with an error "handle_sim_inbound_frag: error (2): frag freed, ret_val (11): FRAG_ERROR_MSG_DUPLICATE in fragment" on a loaded environment with a lot of corrected fragmented packets.

This may also occur with Cluster HA; however, correcting packets is negligible in such environments.

PRJ-64472,

PMTR-120815

SD-WAN

In some scenarios, SD-WAN ISP link status may fluctuate between UP and DOWN states. Reduced SD-WAN ARP probing default sensitivity to packet drops.

PRJ-67305,

AAD-9373,

PRJ-66600,

AAD-9375

SD-WAN

VPN traffic outage may occur in ClusterXL environments after a Cluster failover.

PRJ-66776,

PRHF-43782

SD-WAN

In some scenarios, enabling SD-WAN Symmetric Return may lead to elevated CPU utilization on Secure Network Distributor (SND) cores.

PRJ-64870,

PRHF-42485

SD-WAN

In rare scenarios, SD-WAN objects (such as Peer VPN Domain, My VPN Domain, or SD-WAN Internet) may be incomplete, causing SD-WAN rules to match traffic incorrectly.

PRJ-66384,

PRHF-43223

Cloud Firewall

The FWM may unexpectedly exit when attaching a license to a Security Gateway using vSEC license distribution (vsec_lic_cli).

PRJ-67513,

PMTR-125729

Cloud Firewall

Moving Cloud licenses from one pool to another triggers license alignment: If adding a new license to CK fails, license removal will not be initiated on the Security Gateways.

PRJ-69050,

PMTR-127703

Cloud Firewall

When a Cloud license's support contract expires, the system now keeps all gateways licensed and alerts the administrator with remediation steps, instead of silently removing their licenses.

PRJ-68795,

PMTR-127298

Cloud Firewall

Deleting a license pool while Cloud Firewall Gateways are still associated with it causes all licensing operations (add, distribute, remove) to continuously fail until the orphaned reference is manually cleared from the database.

The fix allows licensing operations to complete normally without administrator intervention.

PRJ-65799,

PRHF-42758

VoIP

Security Gateway may drop legitimate H323 traffic with "Illegal H.225(Q931) No Q.931 User-user IE found". Refer to sk184591.

PRJ-44176,

PRHF-25992

Scalable Platforms

Gaia Portal and Gaia gClish of a Maestro Security Group do not show newly created Loopback interfaces.

PRJ-50825,

PMTR-97166

Scalable Platforms

Added the ability to send ping requests (ICMP) from the management interface of a standby site member when using Hide mode or Same VMAC mode.

PRJ-58702,

PMTR-97177

Scalable Platforms

The command "set backup restore ftp" executed in gClish is applied only to the SMO member and not to all Security Group members.

PRJ-64156,

PMTR-120199

Scalable Platforms

In some scenarios, when proxy ARP is used, unloading and reloading the policy causes members to enter a down state with a configuration pnote.

PRJ-60808,

PMTR-109844

Scalable Platforms

The HCP configuration sync verifier ("config_verify") incorrectly reports a failure because the asg_diag_file.dat file is not synced between members.

PRJ-67645,

PRHF-44577

Scalable Platforms

When adding or removing VS, if the freeze timeout ended before the VS was fully stable, the VS might still have a Critical Device (pnote), which will cause the member to go down. Refer to sk185115.

PRJ-67458,

PMTR-109489

Scalable Platforms

When performing a SIC reset after Anti-Malware (AMW) has been installed, some members may enter a "cluster-down" state with an AMW Critical Device.

PRJ-64975,

PMTR-121215

Scalable Platforms

When "g_ClusterXL admin up" is triggered from a non-VS0 member (for example, VS1), the command fails and the upgraded site remains down with a pnote.

PRJ-64753,

PMTR-110923

Scalable Platforms

When running the "show asset all" command on setups with ElasticXL enabled, Disk Model, Serial, and Capacity outputs are not displayed.

PRJ-63907,

PRHF-41940

Scalable Platforms

Policy installation on one Virtual System (VS) fails without a visible error message. Refer to sk184194.

PRJ-63816,

PRHF-41860

Scalable Platforms

On Maestro appliances, /var/log/messages may be flooded with "asg_copy_capture" error messages when the system attempts to retrieve packet capture files that do not exist on remote Security Group members.

PRJ-67348,

PMTR-123997

Scalable Platforms

A Security Group Member may enter a continuous boot loop after the other members were upgraded. An incorrect image file (with an invalid or mismatched MD5 checksum) is presented on the Single Management Object (SMO). As a result, the problematic member fails to complete the autoclone and repeatedly reboots.

PRJ-67184,

PRHF-44401

Scalable Platforms

The SGM400 chassis member uses an incorrect backplane Ethernet (BPEth) drive, causing backplane traffic not to be processed on that member.

PRJ-68807,

PMTR-126879

Scalable Platforms

When a Security Group member transitions from a down state to an active state, the synchronization process with other members in the Security Group may not complete before the recovered member becomes active. This can result in traffic drops because of incomplete state synchronization.

PRJ-66520,

SPC-3384

Scalable Platforms

Rebooting an Active member in the Single Management Object (SMO) role may trigger a brief connectivity loss.

PRJ-66510,

PMTR-121748

Scalable Platforms

When MDPS Resource Separation is enabled, pushing policy under load may cause Single Management Object (SMO) to become unresponsive.

PRJ-65968,

PMTR-92125

Scalable Platforms

After creating a bridge interface using Gaia Portal and rebooting, the Security Gateway state is Down.

PRJ-65962,

PRHF-43121

Scalable Platforms

In a rare scenario, when a VPN-corrected packet is dropped, the packet truncation warning "14 bytes missing" may be seen in the "tcpdump" output.

PRJ-65540,

PMTR-108818

Scalable Platforms

In Maestro or ElasticXL environments with VPN enabled, traffic may be dropped with the log message "fwha_select_should_drop_vmac".

PRJ-65563,

PMTR-101420

Scalable Platforms

Identity Collector connections may be handled incorrectly by a non-SMO Security Group Member after an SMO failover. Refer to sk184461.

PRJ-65597,

PMTR-122629

Scalable Platforms

Intermittent VS failover when both Maestro Hyperscale Orchestrators (MHOs) have the interface link state set to Down. Refer to sk184568.

PRJ-66119,

PRHF-41852

Scalable Platforms

BGP Sessions may fail to re-establish after SMO failover because of physical link failure. Refer to sk184371.

PRJ-69876,

PMTR-127622

Scalable Platforms

In VSLS clusters with multiple members, when a member rejoins the cluster after a reboot, an Interface Active Check (IAC) problem notification may incorrectly appear on the rejoining member, showing it in ACTIVE state. This occurs even though all interfaces are physically UP and the cluster is fully functional.

PRJ-65700,

PMTR-122627

Scalable Platforms

"TCP packet out of state" or "connection dropped due to state mismatch" messages may be seen in SmartLog or SmartView Tracker. These drops specifically occur on the sync interface, which is used for internal communication and synchronization between Security Group members.

PRJ-67165,

PRHF-43859

Scalable Platforms

• When a large number of bond interfaces are configured, the synchronization of link states may fail.

• In rare scenarios, a cluster member may become stuck in the "active (sync)" state. When this occurs, the affected member does not handle network traffic as expected.

• There may be inconsistencies in the reported link state across Security Group Members (SGMs), as observed with the "asg stat -v" command.

PRJ-69163,

CST-492

Carrier Security

In a rare scenario, a processed malformed GTP packet may cause the Security Gateway to crash.

PRJ-66713,

CST-439

Carrier Security

A "Tunnel established" message may be printed for rejected sessions. The issue is cosmetic.

PRJ-66710,

CST-437

Carrier Security

A GTPv0 tunnel fails to establish under certain conditions.

PRJ-65686,

CST-423

Carrier Security

GTP-U intra-tunnel packets may be dropped with "Packet too short" and "Invalid IP packet" errors in Bridge Mode, preventing proper inspection of encapsulated traffic.

PRJ-65683,

PRHF-42942

Carrier Security

The FWK process may exit when GTP Intra Tunnel Inspection is enabled.

PRJ-65231,

PMTR-121783

Hardware

After upgrading the firmware, the interface on one of the VSX cluster members may go down.

Take 146 - Improvements and Resolved Issues

PRJ-69647,

PMTR-128753

VPN

UPDATE:

• Resolved CVE-2026-50751 - User Authentication bypass on VPN Remote Access and Mobile Access in deprecated IKEv1 key exchange. Refer to sk185033.

• Resolved CVE-2026-50752 VPN site-to-site certificate bypass vulnerability in deprecated IKEv1 key exchange. Refer to sk185035.

PRJ-69506,

PRHF-45889

Security Management

In rare scenarios, the CPD process may exit because of certain Secure Internal Communication (SIC) transactions.

See Critical Information for R81.20 Jumbo Hotfix Accumulator.

Take 141 - Improvements and Resolved Issues

PRJ-67983,

PMTR-126652

Security Gateway

UPDATE: Resolved CVE-2026-48131 - VPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero. Refer to sk184981.

PRJ-67838,

PMTR-126457

Security Gateway

UPDATE: Resolved CVE-2026-48132 - VPN process may restart unexpectedly when processing IKE traffic over NAT-T 4500/UDP. Refer to sk184982.

PRJ-67873,

PMTR-126538

Security Gateway

UPDATE: Resolved CVE-2026-48133 - Identity Awareness Captive Portal - Unauthenticated Local File Inclusion. Refer to sk184993.

PRJ-67835,

PMTR-126454

Security Gateway

UPDATE: Resolved CVE-2026-48134 - SQL injection issue in UserCheck Web Portal when DLP is active. Refer to sk184983.

PRJ-68008,

PMTR-126694

Security Gateway

UPDATE: Resolved CVE-2026-48135 - HTTP service can incorrectly process malformed HTTP requests. Refer to sk184991.

PRJ-68354,

PMTR-126828

Security Management

UPDATE: Resolved CVE-2026-48136 - Authenticated Administrator Role-Based Access Control Bypass in Compliance. Refer to sk184992.

This Jumbo Hotfix Accumulator Take includes dozens of code and functionality hardening changes.

PRJ-65594,

HEC-1347

HCP

UPDATE: Added a new HCP test that analyzes load balancing and NAT utilization, and suggests optimal distribution adjustments accordingly. Refer to sk171436.

PRJ-67789,

ODU-3852,

PRJ-67785,

ODU-3894,

PRJ-68754,

ODU-4023

Automatic Updates - Web SmartConsole

UPDATE: New features and improvements are released in Take 165 via self-updatable package. Refer to sk170314.

PRJ-66727,

ODU-3666

Automatic Updates - Log Exporter

UPDATE: Added Take 53 to Log Exporter Auto Update Deployment. Refer to sk182866.

PRJ-66618,

ODU-3347

Automatic Updates - Security Management

UPDATE: Added Update 4 of Server-Side Change Report Generator Release Updates. Refer to sk179508.

PRJ-67187,

ODU-3845,

PRJ-68134,

ODU-3901

Automatic Updates - Policy Insights

UPDATE: Added Take 82, Take 87 of Policy Insights Release Updates. Refer to sk183421.

PRJ-67224,

ODU-3738,

PRJ-67866,

ODU-3957

Automatic Updates - HCP

UPDATE: Added Update 26, Update 27 of HealthCheck Point (HCP) Release. Refer to sk171436.

PRJ-67227,

ODU-3467

Automatic Updates - Threat Prevention

UPDATE: Added Update 28 of Autonomous Threat Prevention Management Integration Release. Refer to sk167109.

PRJ-67869,

ODU-3950

Automatic Updates - CPSDC

UPDATE: Added Take 43 of Check Point Support Data Collector (CPSDC) for Scalable Platforms and Maestro Security Appliances. Refer to sk164414.

PRJ-68481,

PMTR-127053

CPView

The CPVIEWD daemon may exit during startup.

PRJ-68886,

PRJ-68715,

PMTR-127505

VPN

Remote Access Endpoint Security Client may disconnect and reconnect approximately every 15 seconds.

Take 127 - Improvements and Resolved Issues

PRJ-67137,

ODU-3698

Automatic Updates - CPView

UPDATE: Added Take 88 of CPViewExporter Release Updates. Refer to sk180521.

PRJ-67143,

ODU-3682

Automatic Updates - CPView

UPDATE: Added Take 223 of CPotelcol (OpenTelemetry Collector) Release Updates. Refer to sk180522.

PRJ-67134,

ODU-3714,

PRJ-66545,

ODU-3619

Automatic Updates - Web SmartConsole

UPDATE: New features and improvements are released in Take 163, Take 164 via self-updatable package. Refer to sk170314.

PRJ-67187,

ODU-3845

Automatic Updates - Policy Insights

UPDATE: Added Take 87 of Policy Insights Release Updates. Refer to sk183421.

PRJ-66140,

PMTR-122910

Threat Prevention

File downloads may get stuck at 100% completion when either the Anti-Virus or Threat Emulation Software Blade is actively scanning the file.

See Critical Information for R81.20 Jumbo Hotfix Accumulator.

Take 126 - New Functionality

PRJ-64972,

AAD-4768

VPN

NEW: Added support for nested groups with host/range/network objects for split tunnel on exclusion/inclusion options. Refer to Dynamic Split Tunneling for SaaS Using Updatable Objects.

Take 126 - Improvements and Resolved Issues

PRJ-64530,

PRHF-42420

Security Management

UPDATE: In environments with hundreds of users and user groups, policy installation duration is significantly improved.

PRJ-64004,

PMTR-119902

SecureXL

UPDATE: Improved Debug Filtering for specific flows in SecureXL User Space Mode (UPPAK) debug messages.

PRJ-61644,

PMTR-115879

Security Management

In rare scenarios, CME (Cloud Management Extension) fails to run because of the Management API command "show-simple-gateway" fails. The CME logs show such entries: "Product - CMESeverity - criticalDescription - Error during synchronization with Security Gateways. Error details: Failed to scan for gateway instances in the cloud account".

PRJ-56729,

PRHF-35654

Security Management

In some scenarios, Compliance Software Blade presents the results of Firewall Best Practices as "N/A".

PRJ-62808,

PRHF-40437

Security Management

Running a Packet Mode search using the Management API for a service object fails to match the correct service rules.

PRJ-63825,

PRHF-41884

Security Management

Best Practices may be missing or show incorrect results in the Security Best Practices view of the Compliance Software Blade. Refer to sk184239.

PRJ-63947,

PRHF-41979

Security Management

Policy installation may fail when an inline layer is used more than once in the same policy and this error is displayed "Policy installation had failed due to an internal error. If the problem persists please contact Check Point support".

PRJ-62086,

PRHF-40511

Security Management

In a Full High Availability (HA) ClusterXL deployment, the Check Point Portal does not display the Active Management Server as connected. As a result, Configuration Sharing is not working as expected in the Check Point Portal.

PRJ-62988,

PRHF-41049

Security Management

In some scenarios, when updatable objects are used in the policy, policy installation fails with error code "0-2-2000245". Refer to sk183844.

PRJ-61152,

PRHF-39622

Security Management

The Management API command "add server-certificate" may fail with the "Invalid parameter for [base64-certificate]. The certificate is not valid because it is longer than 10000 characters" error, even though the certificate is valid.

PRJ-62313,

PRHF-40748

Security Management

The FWM process may leak and then exit.

PRJ-63589,

PMTR-119207

CPView

In some scenarios, the CPD daemon may exit with core dumps.

PRJ-64205,

PMTR-120236

CPView

Apostrophes used in CPView strings cause CPDiag to fail. CPView History data is not shown. Refer to sk184873.

PRJ-63226,

PRHF-40388

Logging

In some scenarios, disk space on the Security Management Server may increase significantly if PostgreSQL database log rotation does not function as expected.

PRJ-64467,

PRHF-42386

Logging

In some scenarios, exporting logs to CSV in SmartView fails and the LOG_INDEXER process unexpectedly exits. Refer to sk184475.

PRJ-65363,

PMTR-122317

Logging

Improper memory handling within the CPD daemon may result in unexpected process restart.

PRJ-63383,

PRHF-41504

Security Gateway

In rare scenarios, the FWK process may exit when parsing an invalid SIP packet.

PRJ-63234,

PRHF-41491

Security Gateway

Enabling the ForceAuth option for Remote Access VPN fails because of a typo in the saml_force_authn_override.sh script (sk182042).

PRJ-59891,

PRHF-38489

Security Gateway

In rare scenarios, the FWK process may exit with core files because of a segmentation fault.

PRJ-65052,

PRHF-42145

Security Gateway

In some scenarios, SNMPv3 monitoring fails on Data Plane when MDPS is enabled. Refer to sk184379.

PRJ-65130,

PMTR-108249

Security Gateway

A PYTHON3.11 zombie process may be running in the background without impact on system performance.

PRJ-59978,

PRHF-38572

Threat Prevention

In some scenarios, the Anti-Virus Software Blade fails to load external IoC feeds with an error "Can not load indicators feed without AV & AB Blades enabled, please enable AV & AB and try again", although the Anti-Virus and Anti-Bot Software Blades are enabled in a Maestro environment. Refer to sk183200.

PRJ-60570,

PRHF-39093

Content Awareness

In some scenarios, a memory leak may occur in the DLPU process. The /var/log/ directory on the Active Cluster member reaches critical disk usage levels.

PRJ-63610,

PMTR-119233

IPS

In rare scenarios, the IPS update package may become corrupted. This could cause the Security Gateway to load the initial policy instead of the active security policy.

PRJ-66118

Anti-Virus

In rare scenarios, the MTA process may crash when the Anti-Virus and Threat Emulation Software Blades are enabled.

See Critical Information for R81.20 Jumbo Hotfix Accumulator.

PRJ-66541,

PMTR-123417

SSL Inspection

SSL Network Extender (SNX) package installation fails with a verification error.

See Critical Information for R81.20 Jumbo Hotfix Accumulator.

PRJ-63691,

PMTR-118658

SecureXL

In some scenarios, the USIM_X86 process may become unresponsive.

PRJ-62706,

PRJ-61390

SecureXL

When configuring PIM in Sparse Mode across multiple Virtual Systems on a VSX Security Gateway, the Security Gateway may crash, resulting in loss of connectivity.

PRJ-63123,

PMTR-118217

SecureXL

The USIM process may exit with core dumps when debug information is collected.

PRJ-62250,

PMTR-116638

SecureXL

SYN Defender (Synatk) does not recognize or enforce protections on bridge interfaces.

PRJ-64300,

PMTR-120376

SecureXL

When SecureXL is working in User Mode (UPPAK) mode, some packets may sometimes appear twice in the output of the "tcpdump" command.

PRJ-61338

SecureXL

When SecureXL User Mode (UPPAK) mode may be disabled if some scripts are incorrectly edited.

PRJ-62197,

PMTR-114719

SecureXL

When the Security Gateway is working with SecureXL in User Mode (UPPAK) mode, in some scenarios, the USIM process may exit and not restart, although it should.

PRJ-66163

SecureXL

A vmcore dump may be generated when enabling kernel debugs in Kernel Mode (KPPAK) while processing multicast traffic.

PRJ-62565,

PMTR-117103

Routing

When SecureXL runs in User Mode (UPPAK), local IGMP and MLD multicast groups are not added to listener reports. This causes the output of the "show igmp groups" command to miss expected local group memberships. Additionally, the router does not send MLD reports for IPv6 multicast groups, breaking IPv6 Dynamic Routing.

PRJ-65219,

PRHF-42915

Gaia OS

SNMP monitoring systems may report format errors related to the structure of the chkpnt.mib file.

PRJ-63237,

PRHF-41507

Gaia OS

The SSHD process unexpectedly exits on the Multi-Domain Log Server (MLM) after an SSH session ends. Refer to sk183972.

PRJ-59018,

PMTR-110956

Gaia OS

LACP bonds may continue passing traffic when running SecureXL User Space Mode and the value drops below the configured minimum number of links, although the bond interface should stop passing traffic.

PRJ-65222,

PRHF-42944

Gaia OS

When integrating SNMP monitoring systems with Gaia OS, compilation of the GaiaTrapsMIB.mib file with the CHECKPOINT-MIB (chkpnt.mib) may fail. SNMP management stations or MIB browsers (such as HP OpenView, CA Spectrum, or HP Network Node Manager) return errors like "File GaiaTrapsMIB.mib failed to parse" or "ERROR : Cannot find symbol file://GaiaTrapsMIB.mib:Line XX:Column XX:multiDiskName".

PRJ-55464,

PRHF-33954

Gaia OS

On a Scalable Platform Security Group, although an SHA hash type was configured for Gaia OS passwords with the Gaia gClish command "set password-controls password-hash-type", the Gaia gClish command "set expert-password" saves the password as an MD5 hash in the Gaia OS database. Refer to sk182339.

PRJ-47248,

PMTR-91857

VPN

Capsule VPN for Android / Capsule Connect for iOS / Capsule VPN Plugin for Windows lose access to internal resources. Refer to sk180661.

PRJ-62343,

PRHF-40386

VPN

In some scenarios, only a partial list of traffic selectors may be sent during tunnel negotiation for Remote Access IKEv2 tunnels.

PRJ-63696,

PMTR-119366

VSNext

When capturing packets on a warp interface in a Virtual System (VS) of a VSX Security Gateway with SecureXL User Mode (UPPAK) enabled, certain reply packets may not be captured, for example, ICMP Echo Replies to traffic directed at the Security Gateway.

PRJ-65568,

HEC-1345

VSNext

In the VS0 context, physical resources per VS may not be visible when using the "cpview -m" command, although they are available in the CPView tool.

PRJ-64069,

PRHF-41754

SDWAN

In SD-WAN overlay environment when there is no matching rule, the /var/log/messages files may contain many the errors "could not find rule uuid for connection" and "invalid return value from callback".

PRJ-64392,

PMTR-119685

Scalable Platforms

When adding a subordinate to an LACP bond, a member may go down, which triggers a site failover.

PRJ-62493,

PMTR-119734

Scalable Platforms

In a Maestro Security Group with a Threat Prevention policy applied, performing an SIC reset may cause non-Single Management Object (non-SMO) Security Group members to enter a Down state. The affected members display an Anti-Malware pnote as the reason for the state change.

PRJ-64387,

PMTR-120706

Scalable Platforms

In a Maestro deployment, the $PPKDIR/conf/adpkern.conf file may not be synchronized across Security Group members.

PRJ-65969,

PMTR-92125

Scalable Platforms

After creating a bridge interface via Gaia Portal and rebooting, the Security Gateway state is down.

PRJ-44882,

PRHF-21006

Carrier Security

GTPv1 traffic may be dropped with code description "Invalid IE length value", "GTP info: Parsing IE type 133 failed".

Take 122 - New Functionality

PRJ-64538,

PMTR-119998

VPN

NEW: It is now possible to add host/range/network objects for split tunnel on exclusion/inclusion options. Refer to R81.20 Remote Access VPN Administration Guide > Dynamic Split Tunneling for SaaS Using Updatable Objects.

Take 122 - Improvements and Resolved Issues

PRJ-62102,

PMTR-116716

Harmony Endpoint

UPDATE: Check Point response to Apache Tomcat CVEs on Harmony Endpoint Security Management Server - CVE-2025-31651 and CVE-2025-31650. Refer to sk183615.

PRJ-62360,

PRHF-40849

Security Management

UPDATE: Policy verification error messages are now improved for scenarios when verification fails because of updatable objects, dynamic objects, and Domain objects in a Remote Access VPN community.

PRJ-63718,

PMTR-119125

Gaia OS

UPDATE: Added ability to use the '.', '@', '~', and ',' characters for non-local users using the Gaia Clish command "set aaa allow-unsanitized-username enable <all/dot/at/comma/tilde>". Refer to sk183201.

PRJ-64184,

PMTR-118961

Security Management

UPDATE: JRE is updated from version 8.0_8.35 to version 8.0_8.50

PRJ-63472,

PMTR-117101

Security Management

UPDATE: SmartTasks are now supported in the System Domain of Multi-Domain Security Management. This feature enables the automation of system-domain operations, reducing manual tasks and enhancing reliability. Refer to R82 Security Management Administration Guide > Preferences and Management Settings > SmartTasks.

PRJ-63365,

MGMTTECH-621

Security Management

UPDATE: Enhanced packet search in SmartConsole with three IP address modes:

• "Exact": Returns rules where the IP address/network in the rule is exactly the same as the IP address/network in the search.

• "Containing": Returns rules where the IP address/network you searched for contains the IP address/network of the rule.

• "Contained in": Returns rules where the IP address/network you searched for is contained within the IP address/network of the rule.

PRJ-63735,

PMTR-119349

Security Gateway

UPDATE: Added a new kernel parameter "up_rulebase_run_implied_rules" (enabled by default with the value "1"). Setting the value to "0" disables execution of implied rules in the Access Control Rule Base.

PRJ-59065,

PRHF-32989

CloudGuard Network

UPDATE: CloudGuard Controller status in SmartConsole is now automatically updated.

PRJ-65287,

ODU-3387

Automatic Updates - Web SmartConsole

UPDATE: New features and improvements are released in Take 157 via self-updatable package. Refer to sk170314.

PRJ-62554,

PRHF-40800

Security Management

In SmartConsole, if the Task pane has no tasks to show, the Task pane incorrectly shows an "Error retrieving results" message.

PRJ-62992,

PRHF-41249

Security Management

Regenerating a token for a Security Gateway in Smart-1 Cloud may fail with an unclear validation message "No error in result from fwm command: [gen-pki-cert-req]".

PRJ-62777,

PRHF-41168

Security Management

In rare scenarios, High Availability synchronization might fail with a connectivity error.

PRJ-60374,

PRHF-38836

Security Management

VMcore crashes may occur with core dumps of the LOG_INDEXER, LOG_EXPORTER, and JAVA processes on the Security Management Server, causing high CPU utilization.

PRJ-62550,

PMTR-117467

Security Management

In rare scenarios, the Security Management Server fails to start after performing a "Revert to Revision" operation.

PRJ-64884,

PRHF-42660

Security Management

In rare scenarios, login using Management API fails with a timeout and the "api status" command shows the "API readiness test failed" message. Refer to sk184342.

PRJ-60526,

PRHF-38743

Security Management

When running the Management API command "mgmt_cli -r true gaia-api/set-ntp target pocsms enabled true --format json", the output is not the same as running it directly from Gaia API. Refer to sk184510.

PRJ-62531,

PRHF-40750

Security Management

Importing a large policy package fails with validation and API errors on the Multi-Domain Security Management Server. Refer to sk183697.

PRJ-65808,

PRHF-43517

Security Management

The Management API command "show-packages" executed with the "async-response" parameter may fail with "generic_err_invalid_parameter_name".

PRJ-60488,

PRHF-39032

Security Management

In some scenarios, when Configuration Sharing is enabled, audit logs may show failed login attempts to the CPM Server after publishing changes.

PRJ-61808,

PRHF-40205

Security Management

When a user with read-only permissions for Global Domains (for example, a user with the Global Manager profile) connects to the System Domain in SmartConsole, the SmartConsole status bar incorrectly displays the user as having read-write permissions.

PRJ-59750,

PRHF-38490

Security Management

In some scenarios, creating a Standby Domain Security Management Server fails with a "You do not have the permissions to complete this action" message.

PRJ-59515,

PRHF-37612

Security Management

In rare scenarios, after an IPS update, all protections are set to Staging mode in Threat Profiles configured with "Set activation as Staging mode".

PRJ-62194,

PMTR-116551

Security Management

When using the Management API command "set-threat-protection", overriding either the "packet-capture" or "track" values also overrides the "action" field and sets it to "inactive".

PRJ-64739,

PMTR-121337

Security Management

When the Dynamic URL List feature is enabled, Security Gateway may crash during policy installation.

See the Critical Information for R81.20 Jumbo Hotfix Accumulator.

PRJ-61327,

PRHF-39881

Security Management

In rare scenarios, an IPS update fails because of duplicate objects.

PRJ-63543,

PMTR-119007

Multi-Domain Security Management

On the Multi-Domain Security Management Server, when staging is cleared for an IPS protection in the Global Domain, any staging configuration for that same protection in the local Domain (within a Global profile) remains unchanged during policy assignment.

PRJ-64104,

PMTR-120043

Multi-Domain Security Management

The Configuration Sharing feature does not work as expected with VSX Gateways on a specific Domain.

PRJ-65235,

PMTR-121265

Multi-Domain Security Management

In certain scenarios, an upgrade of the Multi-Domain Security Management Server may fail with a "During synchronization a new object was found through a relationship that was not marked cascade PERSIST" message.

• The fix will only be applied if the upgrade to this Jumbo Hotfix Take is done using a Blink image or with the Advanced Upgrade method.

PRJ-63792,

PRHF-41803

Multi-Domain Security Management

On Multi-Domain Security Management Servers, custom Compliance Software Blade Best Practices may differ between the Multi-Domain Security Management level and the Domain level.

PRJ-55866,

PRHF-34777

CPView

CPView may display incorrect concurrent connection statistics (negative values) because of improper aggregation of connection data during a Cluster failover.

PRJ-64040,

PMTR-118032

Security Gateway

In a rare scenario, when running the "cpstart;cpstop" commands, the Security Gateway may crash.

PRJ-62131,

PRHF-40631

Security Gateway

The FWK memory leak may occur during FTP connections with high file volume. Refer to sk183662.

PRJ-56832,

PRHF-35857

Security Gateway

Potential memory leak in the CPD process.

PRJ-60990,

PMTR-110282

Security Gateway

In some scenarios, when SecureXL is working in User Mode (UPPAK) mode, QoS service is unable to start, displaying the "QoS is not responding. Verify that QoS is installed on the gateway" error. Refer to sk183752.

PRJ-64396,

PMTR-120304

Security Gateway

When changing the CoreXL configuration (for example, adjusting the number of SND and FW instances), a network interface may unexpectedly go down. This can cause traffic disruption.

PRJ-64492,

PMTR-120932

Security Gateway

The Security Gateway may drop packets and potentially crash because of memory allocation issues.

PRJ-62919,

PMTR-117427

Security Gateway

Infinite routing loop may occur because of TTL handling in SecureXL Medium Path. Refer to sk183728.

PRJ-63941,

PRHF-41674

Security Gateway

In a Maestro Security Group in the VSX mode, the Layer 2 MAC address table in Bridge Mode (Bridge Forwarding Database) entries may be incorrectly deleted, causing connectivity issues.

PRJ-65818,

PMTR-122907

Security Gateway

When using a Security Gateway as a Proxy "Non-transparent" and HTTPS Inspection is set to "Inspect" with "X-Forward-For header", video playback on YouTube fails.

See Critical Information for R81.20 Jumbo Hotfix Accumulator.

PRJ-63029,

PMTR-117588

Security Gateway

Web browsing is slow, or pages freeze after an upgrade when using Security Gateway as an HTTP/HTTPS Proxy. Refer to sk184683.

PRJ-57793,

TEMTA-1237

Threat Prevention

In some scenarios, Mail Transfer Agent (MTA) file type classification may be inaccurate when both MTA and Threat Emulation are enabled.

PRJ-61473,

PMTR-115790

IPS

In some conditions, the Packet Capture may be missing from IPS logs in SmartConsole.

PRJ-63324,

PRHF-41553

HTTPS Inspection

In some traffic flows, packets containing certain headers may be dropped regardless of how the non-compliant HTTP Inspection is configured.

PRJ-62830,

PRHF-41229

Mobile Access

In rare scenarios, Mobile Access SmartConsole Logs may not match views/queries, including the "MAC address" or "Methods" field names.

PRJ-62836,

PRHF-39978

Mobile Access

Mobile Access Software Blade may incorrectly terminate Guacamole-based clientless RDP/SSH sessions due to client idleness.

PRJ-60481,

PMTR-110991

Mobile Access

Mobile Access SSL Network Extender (SNX) remote users with Windows 11 24H2 fail to connect. Refer to sk182923.

PRJ-58679,

PMTR-110608

SecureXL

Concurrent NAT64 and NAT46 operations may cause packet processing threads to become unresponsive because of improper issue handling in the SIM v6 kernel module.

PRJ-59484,

PRHF-37901

SecureXL

When using DOS Deny List, CPU usage may increase.

PRJ-59481,

PRHF-38329

SecureXL

When using DOS Deny List, a firewall kernel module memory leak may occur.

PRJ-64329,

PMTR-120628

SecureXL

When using MDPS with IPv6 disabled on the Security Gateway side, the Security Gateway may leak IPv6 packet buffers instead of dropping them. Refer to sk184419.

PRJ-43137,

STRM-499

SecureXL

In rare scenarios, Fast Accel flow may result in SecureXL Kernel Space Mode (KPPAK) crash.

PRJ-64142,

PMTR-120092

SecureXL

In a Maestro setup, the USIM process may exit under high load when handling encrypted VPN traffic with the other Security Gateway.

PRJ-60844,

PRHF-39251

SecureXL

In some scenarios, the Security Gateway may crash when IoC feed contains an IPv6 address.

PRJ-62420,

PMTR-115630

SecureXL

In some scenarios, the Security Gateway may crash.

PRJ-64333,

PMTR-120460

SecureXL

Potential USIM process exit when using virtio devices and changing the MTU value.

PRJ-64456,

PMTR-120707

SecureXL

Traffic may be disrupted when reconfiguring the virtual hardware interfaces.

PRJ-64880,

PRHF-42050

SecureXL

When a VLAN interface is configured as the synchronization interface for the VSX cluster and SecureXL User Mode (UPPAK) is enabled, Virtual Systems on non-active members cannot forward traffic to Virtual Systems on the active member through a warp interface.

PRJ-64612,

PMTR-121137

SecureXL

Multiple threads may be performing a routing next hop lookup for the same next hop at the same time, causing a rare race condition and USIM-related processes to exit.

PRJ-57693,

PMTR-109360

SecureXL

Multiple "radix_get_value" messages may appear in the $FWDIR/log/fwk.elg log files.

PRJ-61615,

PMTR-116026

SecureXL

The USIM process may exit when multiple routes are using the same nexthop and the nexthop is not yet resolved

PRJ-62959,

PMTR-117546

SecureXL

The USIM process may exit when viewing the fg_conn table using the "fwaccel tab -t" command.

PRJ-62907,

PMTR-118106

SecureXL

The USIM process may exit during the FWK restart.

PRJ-61311,

PMTR-115500

SecureXL

In some scenarios, the VSX Security Gateway may not route traffic correctly for non-accelerated connections and accelerated connections that require Active or Passive Streaming when SecureXL User Mode (UPPAK) is enabled.

PRJ-61826,

PRHF-40390

SecureXL

Interface cards are not displayed in the output of the Gaia Clish command "show asset network" when SecureXL User Mode (UPPAK) and MDPS are enabled. Refer to sk184218.

PRJ-61622,

PMTR-116027

SecureXL

Rate Limiting policy installation (when the Rate Limiting policy is updated or country code data is updated) may take a long time.

PRJ-65295,

PMTR-122243

SecureXL

SecureXL hardware offload fails when a bond (link aggregation) is configured with two UP (active) member interfaces.

See Critical Information for R81.20 Jumbo Hotfix Accumulator.

PRJ-63261,

PRHF-29936

Gaia OS

The Gaia Clish command "lldpneighbors" may have a corrupted output in case of extensive data. Refer to sk182065.

PRJ-62337,

PRHF-40826

Gaia OS

LLDP data formatting issues when querying using SNMP. Refer to sk183733.

PRJ-60765,

PRHF-39354

Gaia OS

DHCP traffic peaks may cause high utilization, potentially impacting connectivity.

PRJ-62465,

PRHF-40902

Gaia OS

SNMP Power Supply trap reports false "Down" status. Refer to sk183702.

PRJ-61976,

PRHF-40429

Gaia OS

When taking snapshots of the Security Group Members, some of them may crash, the dmesg_dumps shows multiple messages occurred before the crash:

"the active connections feature is currently enabled in the SmartView Tracker and due to high load it is making sync too slow to function properly. Therefore, 319489 active connection updates were dropped and no sync updates were lost"

PRJ-62534,

PRHF-40972

Gaia OS

Gaia Portal Session Cookie missing the SameSite attribute. Security scanners and penetration tests flag the missing SameSite attribute as a vulnerability. Refer to sk183645.

PRJ-62040,

PRHF-40558

Gaia OS

The MONITORD process unexpectedly exits on Security Gateways. Refer to sk184076.

PRJ-43417,

PMTR-89314

VPN

The VPN granular encryption link is deleted when changing Security Gateway role.

PRJ-64410,

AAD-4359

VPN

VPN traffic outage may occur in ClusterXL environments after a Cluster failover.

PRJ-62635,

PRHF-40410

VSX

Services fail after Virtual System failover in Maestro dual-site environment using the Same Virtual MAC feature. Refer to sk183956 and sk184194.

PRJ-64095,

PRHF-38127

VSX

In large scale environments, the "cpstat vsx" commands sometimes take a long time to execute or fail.

PRJ-50961,

PMTR-97170

VSX

Creating a Virtual System (VS) with an IPv6-only interface (without configuring IPv4) succeeds without any warning or error. However, after the VS is created and modified, pushing the configuration fails with "In a VSX cluster, IPv6-only interfaces are not supported. Virtual System Processing Completed with Errors".

PRJ-60523,

PRHF-38972

VSX

On a VSX Cluster Member, the FWK process may exit with a core dump and cause BGP session drops, resulting in 10-15 second network outages. Error messages in the core dumps and logs include TLS-related backtraces and memory corruption errors.

PRJ-63507,

PRHF-41452

CloudGuard Network

Registration of an updated Data Center asset to the Security Management Server may fail.

PRJ-59518,

PMTR-111921

SD-WAN

A Virtual System may lose connectivity on the Backup and the Standby member when route-based traffic is configured with specific SD-WAN configurations in VSX environments.

PRJ-59584,

PRHF-38432

Scalable Platforms

After enabling Maestro Fastforward on a Security Group, traffic matching relevant rules is routed to the default Security Gateway instead of the correct nexthop because the static route is missing from the /etc/mlx_routing.json file on the Maestro Orchestrator. The Orchestrator shows 200 routes and fails to pick up the interface's routes, despite the interface topology is configured as "according to routes" in SmartConsole.

PRJ-63555,

PRHF-41584

Scalable Platforms

Running the command "ccutil ssm_exec 1 'show system uptime'"generates no output.

PRJ-63617,

PRHF-41710

Scalable Platforms

The "Invalid property name for chassis" error is displayed when changing the "alert_threshold packet_rate_total_threshold_low_ratio" value.

PRJ-63475,

PMTR-119026

Scalable Platforms

Installing policy to the Maestro Security Group under extreme load with Resource Separation may fail.

PRJ-64592,

PMTR-121110

Scalable Platforms

In rare scenarios, in a Maestro setup, traffic interruption may occur after Security Gateway reboots when the Gaia Database is corrupted.

PRJ-62567,

PMTR-119109

Scalable Platforms

When the Maestro Fastforward feature is enabled, policy installation may fail with a "Maestro acceleration (MXL) failed, reason: General error. Please check /var/log/acl_cli.log on the security group SMO for more details" message instead of indicating that it is a policy parser issue.

PRJ-64400,

PMTR-120751

Scalable Platforms

A configuration issue may cause link flapping on bonded uplink interfaces when using Maestro with SecureXL User Mode (UPPAK) enabled. The bond interface may fail to establish connectivity, with the physical interface reporting link status as up but showing unknown speed values.

PRJ-54677,

PMTR-91449

Scalable Platforms

In a Maestro environment, BFD (Bidirectional Forwarding Detection) sessions may flap, slowing down the connections.

PRJ-64803,

PMTR-109427

Scalable Platforms

In rare scenarios, in a Maestro environment, during the Nano-Agent installation, a configuration mismatch between Security Group Members may cause an affected SGM to enter a DOWN state and generate a configuration PNOTE (problem notification).

PRJ-62817,

PRHF-41165

Scalable Platforms

In a Maestro VSX VSLS Cluster, after setting the kernel parameters "fwha_monitor_all_vlan=1" and "fwha_enable_if_probing=1", memory consumption may immediately increase to 100% and cause an outage.

PRJ-62899,

PMTR-118072

Scalable Platforms

In rare scenarios, enabling interface monitoring may cause the FWK process to exit.

PRJ-65635,

PMTR-122661

Scalable Platforms

In the Maestro and Chassis environment with multiple Virtual Systems (VSs) and updatable objects, the disk may reach full capacity. Refer to sk184576.

See Critical Information for R81.20 Jumbo Hotfix Accumulator.

PRJ-64503,

CST-399

Carrier Security

Policy installation fails with an internal error when the Security Gateway policy includes rules that match a specific Access Point Name (APN) for GTPv0 or GTPv1 traffic.

PRJ-63852,

PRHF-31869

Carrier Security

GTP traffic may not be well balanced, some CPU cores may be overloaded while others are underutilized, leading to performance issues.

PRJ-56451,

PRHF-31961

Carrier Security

SAM rules fail to gracefully terminate PDP context when the timer expires.

PRJ-56447,

PRHF-31901

Carrier Security

Running the "snmpwalk" or "stattest" command for any of GX OIDs results in the "No Such Instance currently exists at this OID" error.

Take 120 - Improvements and Resolved Issues

PRJ-63741,

PMTR-119534

Gaia OS

UPDATE: Check Point response to CVE-2019-6109, CVE-2019-6110, CVE-2019-6111. Refer to sk65269.

PRJ-61018,

FMW-5200

Security Gateway

UPDATE: Improve shared memory packet flow and performance.

PRJ-62747,

PRHF-40593

Threat Prevention

UPDATE: Added an option to disable enforcement on internal interfaces when IOC indicators are loaded.

To configure this option, add or modify "[IOC] enable_internal_interface=<value>" in the file $FWDIR/conf/malware_config (on MDS, also in the file $MDS_FWDIR/conf/malware_config). Refer to sk184876.

PRJ-51645,

PRHF-31201

Gaia OS

UPDATE: Added mq_mng.elg to the /etc/cpshell/log_rotation.conf file (sk113241).

PRJ-63581,

PRHF-41198,

PMTR-119173

Harmony Endpoint

UPDATE:

• Directory scanner improvements for large environments.

• Emon JSON data payload management improvements.

PRJ-64246,

ODU-3159,

PRJ-64544,

ODU-3225

Automatic Updates - Policy Insights

UPDATE: Added Take 77 and Take 78 of Policy Insights Release Updates. Refer to sk183421.

PRJ-64476,

ODU-3143,

PRJ-64637,

ODU-3259

Automatic Updates - Web SmartConsole

UPDATE: New features and improvements are released in Take 155 and Take 156 via self-updatable package. Refer to sk170314.

PRJ-64547,

ODU-3175

Automatic Updates - HCP

UPDATE: Added Update 24 of HealthCheck Point (HCP) Release. Refer to sk171436.

PRJ-64585,

ODU-3199,

PRJ-64742,

ODU-3267

Automatic Updates - CPView

UPDATE: Added Take 52 and Take 53 of CPquid (QUID) Release Updates. Refer to sk181458.

PRJ-64828,

ODU-3235

Automatic Updates - Threat Prevention

UPDATE: Added Update 27 of Autonomous Threat Prevention Management integration Release. Refer to sk167109.

PRJ-64904,

ODU-3275

Automatic Updates - CPView

UPDATE: Added Take 210 of CPotelcol (OpenTelemetry Collector) Release Updates. Refer to sk180522.

PRJ-60643,

PRHF-39082

Security Management

In some scenarios, the warning "Threat Prevention Policy: For better performance, blade exception rules with the action 'Inactive' should be placed above other exception rules" appears in SmartConsole even though no exception rules violate the recommended configuration.

PRJ-53003,

PMTR-101178

Security Management

When running "mgmt_cli show central-license", it fails with "code: "generic_error" instead of returning the central license information.

PRJ-63540,

PRHF-41609

Multi-Domain Security Management

In a Multi-Domain Security Management environment, when opening the License tab of a Security Gateway object in SmartConsole, the "Security Gateway was not found" error may be shown.

PRJ-63597,

PRHF-41369

CPView

VSX CPU Usage calculation on multi-core devices may be incorrect.

PRJ-56659,

PMTR-107477

CPView

In VS setups, the cpviewd.elg file grows excessively and fills the /var/log/ partition, causing the Gateway to become unreachable.

PRJ-63313,

PRHF-41539

Security Gateway

The RAD daemon may unexpectedly exit.

PRJ-62825,

PMTR-117944

Security Gateway

When the Gaia Portal accessibility is configured as "According to Firewall policy", access may be denied because of a match on an implied rule with the "Accept" action.

PRJ-63486,

PRHF-41690

Security Gateway

Mirror and Decrypt feature may not function as expected when HyperFlow is enabled.

PRJ-62882,

PRHF-41266

Security Gateway

In some scenarios, when HyperFlow is enabled, websites that use HTTP2 protocol do not load properly.

PRJ-63820,

PRHF-41922

Security Gateway

When a Security Gateway is configured in Bridge Mode, a memory leak may occur.

PRJ-63378,

PRHF-41472

Security Gateway

Threat Emulation on ICAP Server fails with "There was an Unexpected Internal error, Please try again later". Refer to sk184228.

PRJ-63087,

PRHF-40865

Security Gateway

HTTP parsing fails with the "Illegal header format detected: Invalid header field" error.

PRJ-63860,

PMTR-113368,

TPDO-3593

Threat Prevention

In a rare scenario, SmartConsole does not display a notification when the IP reputation feed for the Anti-Bot Software Blade fails to load.

PRJ-61196,

PRHF-39537,

PMTR-115422

Threat Prevention

In rare scenarios, the Anti-Virus Software Blade fails to fetch the external intelligence feed because of an authentication failure.

PRJ-54475,

PRHF-33776

Identity Awareness

In a rare scenario, the PDPD daemon may unexpectedly exit while updating identity session timers.

PRJ-63885,

PRHF-41980

Application Control

In the Application Layer, an "any-any" rule (from any source to any destination, using any service) with long-lived connections may cause excessive memory usage. Refer to sk184196.

PRJ-63431,

PMTR-118983

URL Filtering

In rare scenarios, IoC resources are not loaded or distributed as expected.

PRJ-62488,

PMTR-111667

SecureXL

In some scenarios, the Security Gateway delays offloading a connection to the LightSpeed hardware-accelerated card when SecureXL User Mode (UPPAK) is enabled.

PRJ-62913,

PMTR-118130

SecureXL

In some scenarios, after an update of the OS route configuration, there may be a significant delay in traffic passing through the Security Gateway when SecureXL works in the User Mode (UPPAK). Refer to sk182740.

PRJ-63470,

PMTR-118999

SecureXL

In some scenarios, a VSX Gateway may not optimally pass traffic from a Virtual System to a Virtual Router or Virtual Switch when connections are accelerated in SecureXL.

PRJ-63856,

PMTR-119616

SecureXL

When tunnel is established and traffic is running, the USIM process may exit every 15-20 minutes and cause a failover of the second member.

PRJ-63171,

PMTR-118518

SecureXL

In some scenarios, when a Security Gateway, running in SecureXL User Mode (UPPAK), receives IPv6 Neighbor Discovery Protocol (NDP) packets from the network, it may not properly forward or process them correctly.

PRJ-61340,

PMTR-115628

SecureXL

In some scenarios, there is significant latency when passing traffic through bridge interfaces configured on a Security Gateway when SecureXL User Mode is enabled.

PRJ-63771,

PMTR-119562

SecureXL

VPN cluster members may crash after a cluster failover with BGP enabled and the exit of the USIM process.

PRJ-63601,

PMTR-119184

SecureXL

Security Gateway unexpectedly crashes with kernel logs showing segmentation faults in the USIM_x86 process. Refer to sk184340.

PRJ-63414,

PMTR-118686

SecureXL

In a rare scenario, packets with malformed message headers cause the Security Gateway to crash.

PRJ-63953,

PRJ-63818

VSX

In a rare scenario, the FWM process may exit on the Security Management Server managing VSX Gateways/Clusters.

PRJ-62077,

PMTR-107936

VSX

After enabling Mobile Access Software Blade on a Virtual System, Mobile Access services do not run, and the Mobile Access portal cannot be reached. Refer to sk183256.

PRJ-56048,

PRHF-34615

Gaia OS

After an upgrade from R81 to R81.20, backup on a VSX Gateway may fail with the "Cannot complete the backup process: not enough space in /var/log/CPbackup/backups" error.

PRJ-63210,

PRHF-41484

Gaia OS

After an upgrade, the scheduled SFTP backup configuration is not fully displayed in the "show configuration" output. Refer to sk184093.

PRJ-62007,

SDWANGW-4494

SD-WAN

In rare scenarios, policy installation causes traffic matched by the "prefer local breakout" rule to be incorrectly routed through the underlay private link instead of the overlay.

PRJ-62761,

PMTR-117824,

SDWANGW-4233

SD-WAN

In rare scenarios, new connections may continue matching "Prioritize Local Breakout" despite low ISP quality that should trigger a switch to backhaul.

PRJ-61892,

PRHF-39789

Harmony Endpoint

Posture Management scans initiated manually or automatically remain stuck at the "Scan initialize" status. This issue affects all devices with Endpoint Security installed.

PRJ-61895,

PRHF-39851

Harmony Endpoint

Security Management Server and Policy Server may lose connectivity after uploading production licenses. Running "cplic print -x" on the Policy Server shows no output, while the Security Management Server output is uploaded for review.

PRJ-63037,

PMTR-118317,

EPS-60640

Harmony Endpoint

After upgrading the Endpoint Security Client from a non-compliant version to E88.62 on Azure AD devices (protected by Full Disk Encryption), multiple clients may enter a disconnected state.

PRJ-63461,

PMTR-119023,

EPS-60858

Harmony Endpoint

Full Disk Encryption user update password fails with auth_type 3 (certificate and password).

PRJ-62613,

PMTR-117583

Scalable Platforms

Connectivity issues may occur between Maestro sites that are connected through Cisco OTV switches. Refer to sk183666.

PRJ-60968,

PRHF-39103

Scalable Platforms

In rare scenarios, "asg stat -i chassis_monitor" returns "0" even when the cluster did not start, causing "distutil" to incorrectly update the MHO topology. This can result in a traffic impact when a cluster member recovers from a FWK process exit.

Take 119 - New Functionality

PRJ-62667,

PMTR-116161

Gaia OS

NEW: Hardened the authentication in the Gaia Cloning Group.

Important - After the installation of this Jumbo Hotfix Accumulator Take, you must follow these steps in each current Cloning Group:

1. Make sure this Jumbo Hotfix Accumulator Take is installed on each Cloning Group Member

2. On each of the Cloning Group Members, enter a Cloning Group password - enter the current password again or a new password.

3. On each Cloning Group Member, re-synchronize the Cloning Group.

For more information, see the Gaia Administration Guide > Chapter "System Management" > Section "Cloning Group".

PRJ-62142,

PMTR-116780

CPView

NEW: Added the new Skyline metric "system.traffic.templates". Refer to the Skyline Administration Guide > Skyline Metrics Repository > System > Traffic.

Take 119 - Improvements and Resolved Issues

PRJ-63002,

PMTR-117744

Gaia OS

UPDATE: Check Point response to CVE-2025-32728 - The SSH directive "DisableForwarding" fails to disable "X11 Forwarding" and "Agent Forwarding". Refer to sk183394.

PRJ-59093,

PRHF-37840

Security Management

UPDATE: It is possible now to run the Management API command "show-packages" asynchronously using the "async-response" parameter.

PRJ-62340,

PMTR-115295

CPUSE

UPDATE: Added an HCP test to check whether the CPAC-2-100/25F, CPAC-2-100/25F-B, CPAC-2-40F-B, or CPAC-2-40F-C FW firmware is safe to update from R81.10 to a higher version. Refer to sk182403.

PRJ-61801,

PRHF-39531

Logging

UPDATE: The SOLR process (listening on port 8211) no longer accepts connections using the TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA cipher suite. Refer to sk181683.

PRJ-62728,

PMTR-117738

Logging

UPDATE: Improved the design of the Security Checkup report in SmartView.

PRJ-62472,

PMTR-117312

IPS

UPDATE: HTTP/1.1 requests missing host headers are now processed by the non-compliant HTTP Protection feature (Strict Parsing option). Previously, such requests were dropped immediately. Refer to sk183569.

PRJ-60141,

PMTR-87460,

PRJ-60463,

PMTR-114416

SecureXL

UPDATE: SecureXL Rate Limiting rules for DoS Mitigation now support these parameters with automatic IP range updating enabled by default:

• "cc:<COUNTRY_CODE>"

• "asn:<AUTONOMOUS_SYSTEM_NUMBER>"

Refer to sk112454.

PRJ-61324,

PRHF-39697

CloudGuard Network

UPDATE: Updated supported regions in OCI (Oracle Cloud Infrastructure) data centers and changed the fetching domain logic.

PRJ-63517,

ODU-3040

Automatic Updates - CPView

UPDATE: Added Take 201 of CPotelcol (OpenTelemetry Collector) Release Updates. Refer to sk180522.

PRJ-63521,

ODU-3064,

PRJ-63712,

ODU-3111

Automatic Updates - Web SmartConsole

UPDATE: New features and improvements are released in Take 149 and Take 150 via self-updatable package. Refer to sk170314.

PRJ-63781,

ODU-3095

Automatic Updates - Policy Insights

UPDATE: Added Take 76 of Policy Insights Release Updates. Refer to sk183421.

PRJ-63899,

ODU-3127

Automatic Updates - CPView

UPDATE: Added Take 50 of CPquid (QUID) Release Updates. Refer to sk181458.

PRJ-62243,

PMTR-116383

Security Management

In rare scenarios, the FWM process on the Security Management Server may unexpectedly exit, creating a core dump file because of the incorrect license update.

PRJ-57301,

PRHF-35813

Security Management

In rare scenarios, the User Check policy is not updated during the Accelerated Policy installation.

PRJ-62664,

PRHF-41094

Security Management

When Global Domain Assignment removal fails with the "Global Domain Assignment failed: object XXX could not be deleted because it is referenced by other objects" error, only a partial list of the referencing objects is displayed in the error message.

PRJ-61897,

PRHF-40211

Security Management

After editing an Interoperable Device object, the number of changes of the current session presented in SmartConsole may be inaccurate.

PRJ-63199,

PMTR-118466

Security Management

In rare scenarios, the FWM process may not start automatically after an unexpected exit.

PRJ-62637,

PRHF-40995

Security Management

After an IPS update, reassigning global policies may take a long time.

PRJ-61805,

PRHF-40186

Security Management

In rare scenarios, discarding an old session fails with an "An internal error has occurred" message.

PRJ-59981,

PRHF-38312

Security Management

When migrating a Security Management Server to a Multi-Domain Security Management Server more than once, the operation fails with the "got at least one duplicate UID in requested list" error.

PRJ-63489,

MGMTTECH-516

Security Management

Security Management Server upgrade may fail when running out of memory.

PRJ-63104,

PMTR-118295

CPView

In a VSX environment, the CPVIEWD daemon may exit and produce a core dump file.

PRJ-47565,

PRHF-29330

CPView

In CPView > Network > Traffic > in the Concurrent Connections table, the number of non-TCP connections is higher than shown in the output of the "fw ctl pstat" and "fw tab -t connections -s" command. The issue is cosmetic only.

PRJ-62753,

PRHF-41169,

PMTR-117799,

PRHF-41238

CPView

The CPVIEW_SERVICES process may exit because of incorrect database handling.

PRJ-60004,

PRHF-38733

Security Gateway

Policy installation may fail when an updatable object is processed incorrectly.

PRJ-61858,

PRHF-40380

Security Gateway

When configuring NAT64 rules for specific targets, the rules may fail to apply. Return traffic may be dropped.

PRJ-61436,

PRHF-39815

Security Gateway

In Maestro Dual Site in the VSX VSLS mode, although CoreXL Dynamic Balancing is enabled, CoreXL does not change the number of Firewall instances and SND instances during traffic load. Refer to sk183485.

PRJ-62016,

PRHF-40483

Security Gateway

The RAD daemon may unexpectedly exit on VSX Gateways.

PRJ-59450,

PRHF-38172

Security Gateway

An application may fail to match correctly when URL Filtering is configured in Hold Mode.

PRJ-60294,

PRHF-28489

Security Gateway

In rare scenarios, the Security Gateway may drop the traffic with "up_manager_fw_handle_first_packet: cmi_context_exec_with_chain_connkey() failed". Refer to sk182506.

PRJ-62894,

PRHF-41242

Security Gateway

HTTP/2 connection may fail when Threat Prevention Software Blades are enabled with Deep Inspection because of a protocol error. Refer to sk183822.

PRJ-62562,

PRHF-41025

Security Gateway

ICAP Server may fail to process multipart HTTP requests (when request body is split into multiple parts, each with its own headers and content).

PRJ-63022,

PMTR-117719

Threat Prevention

In a rare scenario, the DLPU process may exit during traffic inspection when holding a connection.

PRJ-58193,

PRHF-37156

Threat Prevention

In some scenarios, the Anti-Virus Software Blade fails to parse and load external IoC observables of type IPv6. Refer to sk182947.

PRJ-61618,

PRHF-40065

Threat Prevention

The testing of external IoC feed connectivity from SmartConsole fails because of improper retrieval of configuration values.

PRJ-60586,

PRHF-38756

Identity Awareness

Users on shared Servers (MUH v1 and v2) cannot access resources they should have permission to use. When this happens, the Security Gateway fails to recognize the user's identity and does not apply the correct access permissions. Refer to sk183268.

PRJ-60982,

PRHF-39261

Identity Awareness

Entra ID (Azure ID) authorization may fail when more than one tenant is configured for authorization and the "fetch-user-group"s or "fetch-machine-groups" mode is enabled.

PRJ-58058,

PRHF-36813

IPS

In rare scenarios, the source IP shown in the IPS detection log is invalid. Refer to sk182914.

PRJ-62811,

PRHF-41088

IPS

When using Gateway as a Proxy "Non-transparent" and HTTPS Inspection is set to "inspect" with "X-Forward-For header", video playback on YouTube fails.

PRJ-63061,

PMTR-118347

Anti-Virus

In a rare scenario, the Security Gateway may crash during traffic inspection.

PRJ-63025,

PMTR-116661

Anti-Virus

In some scenarios, the Anti-Virus Software Blade reaches a timeout when inspecting Domains because of latency in the RAD daemon.

PRJ-61302,

PRHF-39517

Anti-Virus

In a rare scenario, the memory consumption of the DLPU process continuously increases.

PRJ-44982,

PRHF-27785

Anti-Virus

In rare scenarios, the Anti-Virus Software Blade cache may reach its capacity.

PRJ-61582,

PMTR-115396

ClusterXL

6in4 tunnels are shown in Down state when monitored using the "cphaprob -a if" command.

PRJ-62301,

PMTR-115027

ClusterXL

In ClusterXL High Availability (HA), in some scenarios, the Active cluster member stops sending Cluster Control Protocol (CCP) heartbeats, and the Standby member may misinterpret this as an Interface Active Check (IAC) failure.

PRJ-62686,

PRHF-40994

ClusterXL

Modifying the number of CoreXL instances in a VSLS cluster containing three or more members causes traffic interruption on the updated Virtual System.

PRJ-60348,

PMTR-113063

ClusterXL

In cluster environments using Bonds and VLANs, the ClusterXL Monitoring command "cphaprob stat" (Expert Mode) and the Clish command "show cluster state" may display an incorrect failover reason when an interface disconnects or a link goes down.

PRJ-61109,

PMTR-115083

ClusterXL

A rare race condition occurs during "cpstart" command execution in VSX environments that prevents proper sync interface installation, specifically in the cluster flow process, causing synchronization problems between cluster members.

PRJ-59744,

PRHF-38554

ClusterXL

In a ClusterXL setup, a rare performance issue may be caused by policy installation failure.

PRJ-61739,

PMTR-115808

ClusterXL

An FWK core file is generated when configuring a Bridge Group with more than two interfaces.

PRJ-63078,

PMTR-118396

SecureXL

In some scenarios, the DOS/Rate Limiting configuration settings may default to incorrect values during an upgrade from R81.10 to R81.20.

PRJ-63769,

PRHF-41893

SecureXL

When VLAN interfaces are created on top of bond interfaces configured for Load Sharing, connections may not be hardware accelerated if the bond uses multiple ports from the same physical NIC. Refer to sk184291.

PRJ-60627,

PMTR-114633

SecureXL

Memory corruption may occur in rare VPN routing scenarios.

PRJ-62200,

PMTR-116890

SecureXL

SecureXL does not immediately send packets to the appropriate handler when it receives packets from a Virtual Router or Virtual Switch and fails to forward them to the connected Virtual System. This delay causes significant routing delays and potential routing errors on VSX Security Gateways.

PRJ-62263,

PMTR-109269

SecureXL

The USIM core file may be generated when rebooting the Security Gateway.

PRJ-60896,

PMTR-111305

SecureXL

When SecureXL User Mode (UPPAK) is enabled, there can be a significant latency on a Security Gateway when opening an FTP data connection.

PRJ-63077,

PRJ-63054

SecureXL

The link on the 4-Port 10/25GbE CX7 Lightspeed Network Interface Card may fail to establish when multiple 4-port CX7 Lightspeed Network Interface Cards are installed.

PRJ-63120,

PMTR-118447,

FMW-6167

SecureXL

Large packets cause performance slowdown.

PRJ-55276,

PMTR-104579

SecureXL

Local TCP traffic may encounter "out-of-state" connection issues.

PRJ-62887,

PRHF-40086

SecureXL

In cluster environments, on the Active member, the USIM_x86 process may experience frequent core dumps, causing Security Gateway instability.

PRJ-62587,

PRHF-41038

CoreXL

In rare scenarios, CoreXL Firewall instances may become fully utilized because of resource contention from the Parallel Processing Engine (PPE). Refer to sk184183.

PRJ-52995,

PRHF-31534

Routing

In a specific scenario, where SSM static groups are configured on an interface, after a failover, these IP addresses do not appear as Outgoing Interfaces (OIFs).

PRJ-63117,

PRHF-41346

Routing

ASE LSAs for routes sharing the same prefix but having different mask lengths may not be re-originated correctly when a topology change restores previously unreachable routes to a reachable state.

PRJ-61917,

PRHF-40237,

PMTR-116423

VPN

In VSX environments with VS and VR configurations, when Policy-Based Routing (PBR) is configured on the Virtual Router, Remote Access VPN traffic bypasses the PBR table and uses the default route instead.

PRJ-60692,

PMTR-114063

VSX

In rare scenarios in a VSX environment, after a Virtual System (VS) starts, it becomes stuck in Down state with a "FullSync" pnote.

PRJ-62227,

PMTR-110683

VSX

The "vsx-provisioning-tool" CLI command returns asynchronous task IDs before it is ready for monitoring, causing Terraform and similar automation tools to immediately fail when attempting to track task status.

PRJ-59687,

PRHF-38276

Gaia OS

HealthCheck Point (HCP) reports "rx_length_errors" for Security Group Members. Refer to sk183040.

PRJ-62734,

PMTR-117714

Gaia OS

When using Resource Separation on MDPS on Maestro, and the Security Gateway is under extreme load, policy installation fails, although the Resource Separation should handle the load.

PRJ-62584,

PRHF-41027

Gaia OS

The Security Management Server hangs during a Backup operation because of endless SSH handshake retry, making it impossible to access via SSH or CLI.

PRJ-63583,

PRHF-41381

Gaia OS

SNMP query for "vsxStatusInterfaceRxBytes" and "vsxStatusInterfaceTxBytes" OIDs returns "0". Refer to sk183871.

PRJ-62996,

PRHF-41344

Gaia OS

The "show syslog logs" Clish command returns the "cat: /var/log/messages*: No such file or directory" error even though these files exist.

PRJ-62797,

PRHF-41139

CloudGuard Network

In the Smart-1 Cloud environment, in the Gateways & Servers view, newly provisioned CloudGuard Autoscaling Security Gateways may be shown as disconnected.

PRJ-62819,

PMTR-103009

SD-WAN

In rare scenarios, SD-WAN policy installation may fail during a Security Gateway reboot.

PRJ-62408,

PMTR-117173

Scalable Platforms

Security Group members may reboot because of cp-nano database entries. The /var/log/configuration_reboot_reason.log may show "process:cp-nano-watchdog" when database entries exist only on the local member or only on the SMO member.

PRJ-58049,

PRHF-37015

Scalable Platforms

When handling multiple shared uplinks across numerous interfaces, errors related to LACP bond uplink updates may be printed in logs.

PRJ-62175

Scalable Platforms

A "failed to load external entity "/etc/extended_commands/lightshot_partition_extended_cli.xml" message may be printed in console during boot.

PRJ-62803,

PMTR-117683

Scalable Platforms

In Maestro Security Group or Scalable Chassis Security Group with VSX with many Virtual Systems (VSs), boot may take a long time when the database file (/config/active) is very large (200,000 lines or more).

PRJ-58374,

PMTR-110163

Scalable Platforms

In rare scenarios, Security Group members may fail to receive their Gaia database from the Single Management Object (SMO). When this occurs, gClish commands related to these missing Security Group configurations may fail.

PRJ-47991,

PMTR-91235

Scalable Platforms

If L4 is disabled, the data connection may be dropped if it is redirected to a different IP address than the control connection.

PRJ-59790,

PMTR-105687

Scalable Platforms

On the Mobile Access Portal, SAML authentication does not display the login fields in a Maestro Security Group in the VSX. Refer to sk182548.

PRJ-48418,

PRHF-23287

Scalable Platforms

After adding a custom command in Gaia gClish with the "add command", the custom command is available only on the Single Management Object (SMO). Refer to sk178671.

PRJ-59938,

PRHF-38620

Carrier Security

Security Gateway drops GTP traffic with the log "Message includes unexpected information element type". Refer to sk106469.

Take 118 - Improvements and Resolved Issues

PRJ-63624,

PMTR-119268

Logging

UPDATE: Resolved CVE-2025-2028. Lack of TLS validation when downloading a visualization support data file. Refer to sk183349.

PRJ-63916,

PRHF-41964

Security Gateway

Certain User Space processes (for example, PDPD) become unresponsive when working in Firewall Kernel Space Mode. Refer to sk184028.

See Critical Information for R81.20 Jumbo Hotfix Accumulator.

PRJ-63698,

PRHF-38839

Scalable Platforms

SNMP queries for ASG branch and the "asg perf" tool fail after an upgrade on Maestro Security Group. Refer to sk183601.

See Critical Information for R81.20 Jumbo Hotfix Accumulator.

PRJ-57216,

PMTR-107934

Scalable Platforms

Using a Multicast packet over a VPN tunnel may result in high SND CPU usage.

See Critical Information for R81.20 Jumbo Hotfix Accumulator.

Take 115 - New Functionality

PRJ-60278,

PMTR-114156

Application Control

NEW: This Take introduces the Dynamic URL List feature is an enhancement to the Custom Applications / Sites object (sk165094), allowing to maintain a dynamic list of URLs based on a feed file.

Refer to R81.20 Security Management Administration Guide > Topic "Creating Application Control and URL Filtering Rules".

PRJ-60071,

FMW-4386

Scalable Platforms

NEW: Added support for SecureXL User Space (UPPAK) mode on Check Point Firewall 9400 appliances in the Maestro configuration. Refer to sk179432.

Take 115 - Improvements and Resolved Issues

PRJ-63339,

PRHF-41560

HTTPS Inspection,

VPN

UPDATE: Updated CRL and OCSP validation in Remote Access VPN, Site-to-Site VPN, and HTTPS Inspection to use HTTP/1.1 instead of HTTP/1.0. This ensures continued compatibility with DigiCert's updated requirements and prevents certificate validation failures. Refer to sk183884.

PRJ-63089,

PMTR-116712

Security Management

UPDATE: Added a new Gaia Clish command "cplic ignore_expired_ngtx 1" that allows administrators to disable license status monitoring for expired Next Generation Threat Extraction (NGTX) licenses in SmartConsole. Run this command on each Cluster Member or Virtual System that reports an error and restart the services with the "cpstop;cpstart" commands.

PRJ-59692,

MGMTPROD-1385

Security Management

UPDATE: In SmartConsole and Management API, Access and NAT Policies now support Rule Base search for hitcount values.

PRJ-61671,

PMTR-89079

Security Management

UPDATE: Improved the "fw tab" CLI command help by adding descriptive explanations for each option.

PRJ-62307,

PMTR-117039

Security Management

UPDATE: Added the "show-only-local-domain" field to API queries to return only objects from the current local Domain.

PRJ-59692,

MGMTPROD-1385

Security Management

UPDATE: In SmartConsole and Management API, Access and NAT Policies now support Rule Base search for hitcount values.

PRJ-59284,

PRHF-38115

Security Management

UPDATE: JRE is updated from version 8.0_8.26 to version 8.0_8.35.

PRJ-61285,

PRHF-39744

Security Management

UPDATE: The upgrade duration for the Security Management Server and Multi-Domain Security Management Server has been reduced by up to 60%.

• The fix will only be applied if the upgrade to R81.20 Jumbo Hotfix Accumulator Take 115 or higher is done using a Blink image or the Advanced Upgrade method.

PRJ-60363,

PMTR-114192

Security Management

UPDATE: Updated the output of the Gaia Clish command "show asset" with the correct details for the CPAC-4-10/25F-DA acceleration card.

PRJ-62453,

MGMTPROD-1952

Security Management

UPDATE: Added new Management API commands to configure synchronization with User Center: "show sync-with-user-center" and "set sync-with-user-center" which was previously only configurable through the SmartConsole GUI. Refer to sk94064.

PRJ-62156,

PMTR-116839

Logging

UPDATE: Extended the "show logs" API to support Infinity Copilot queries in on-premises logs.

PRJ-61188,

FMW-3427

URL Filtering

UPDATE: URL Filtering now provides better categorization for non-inspected HTTPS connections by proactively re-validating certificates before the Categorize-HTTPS cache entry expires.

PRJ-61815,

PRHF-20323

VPN

UPDATE: Modified the default behavior of the legacy Policy Server daemon (DTPSD). By default, this daemon now starts in the "DOWN" state unless explicitly configured otherwise. Refer to sk183803.

PRJ-54573,

PRHF-33808

Gaia OS

UPDATE: In the Gaia Portal, improved the text of the warning displayed when removing permissions from a user in the Gaia Portal.

PRJ-61641,

PMTR-115412

Gaia OS

UPDATE: In the Gaia Portal login, added support for the period character (".") in RADIUS and TACACS usernames. This feature is disabled by default. Refer to sk183201.

See Critical Information for R81.20 Jumbo Hotfix Accumulator.

PRJ-62422,

VSECPC-10838

CloudGuard Network

UPDATE: Added support for GCP NSI (Google Cloud Platform Network Security Integration) solution.

PRJ-59471,

PMTR-109854

Scalable Platforms

UPDATE: Added option to use the local IP address 127.0.0.1 for license creation for Maestro Security Group members.

PRJ-61787,

PMTR-101696

Scalable Platforms

UPDATE: CPView now monitors the Maestro backplane interfaces, Sync, and Chassis Internal Network (CIN) interfaces.

PRJ-62939,

ODU-2936

Automatic Updates - Web SmartConsole

UPDATE: New features and improvements are released in Take 147 via self-updatable package. Refer to sk170314.

PRJ-63159,

ODU-2706

Automatic Updates - Log Exporter

UPDATE: Added Take 44 to Log Exporter Auto Update Deployment. Refer to sk182866.

PRJ-62738,

ODU-2594

Automatic Updates - Threat Prevention

UPDATE: Added Update 26 of Autonomous Threat Prevention Management integration Release. Refer to sk167109.

PRJ-63264,

ODU-2952

Automatic Updates - HCP

UPDATE: Added Update 23 of HealthCheck Point (HCP) Release. Refer to sk171436.

PRJ-62941,

ODU-2928,

PRJ-63334,

ODU-3024

Automatic Updates - Policy Insights

UPDATE: Added Take 72 and Take 74 of Policy Insights Release Updates. Refer to sk183421.

PRJ-63337,

ODU-2960

Automatic Updates - Scalable Platforms

UPDATE: Added Take 18 of Scalable Platforms (Maestro and Chassis) Release Updates. Refer to sk183156.

PRJ-60012,

PMTR-114030

Security Management

In rare scenarios, policy installation may get stuck at 99%.

PRJ-61586,

PRHF-37905

Security Management

Access Control policy installation may take a long time when updatable objects are used in the policy.

PRJ-61289,

PRHF-39256

Security Management

In rare scenarios, login to the Security Management Server may fail with a timeout.

PRJ-61292,

PRHF-39777

Security Management

The $MDS_FWDIR/log/ directory may contain multiple api_status_UUID.json files.

PRJ-62022,

PRHF-40184

Security Management

In SmartConsole, deleting a license in the Licenses tab of a Security Cluster object fails with the "Domain Management Server licenses cannot be removed from the Domain Management Server level" error.

PRJ-59090,

PRHF-37685

Security Management

Administrators with LSM write permissions cannot delete LSM Gateway objects without also having write permissions for Others/Common Objects.

PRJ-57082,

PRHF-36096

Security Management

In some scenarios, the PostgreSQL database fully utilizes disk space on the Security Management Server.

PRJ-59084,

PRHF-37999

Security Management

Policy installation is delayed because of the FWM process load. Refer to sk183563.

PRJ-59927,

PRHF-38237

Security Management

In some scenarios, the Changes Report is not attached to the email sent by the SmartTask configured with the "After Publish" trigger and the "Send Mail" action.

PRJ-61321,

PRHF-39817

Security Management

Reassigning Global Policy takes a few hours after updating IPS Snort protections.

PRJ-63371,

PRHF-41564

Security Management

Backup file size on the Security Management Server grows after an upgrade. Refer to sk183835.

See Critical Information for R81.20 Jumbo Hotfix Accumulator

PRJ-62183,

PMTR-116869

Security Management

SAML authentication fails for Web SmartConsole on port 4434, redirecting to an invalid URL (https://localhost:4434:4434/smartconsole/transport) and preventing SSO login, while SmartConsole GUI authentication works normally.

PRJ-61668,

PRHF-39885

Security Management

In some scenarios, SmartConsole disconnects when installing policy if there are 50 installation targets or more.

PRJ-59665,

PRHF-37860

Security Management

Compliance scan finishes successfully but does not show any data in SmartConsole.

PRJ-62232,

MGMTPROD-436

Security Management

The Management API command "set-access-rule" returns the error "You must enable the Granularity option 'Session' for the Track option 'Log' if the rule specifies an application or a Contact Type" when adding an application to an Access Control rule with "service" set to "none" and "track" set to "log".

PRJ-57313,

PRHF-36228

Security Management

In some scenarios, the Management API command "where-used" with "details-level" set to "full" may fail with a "generic_internal_error" message, if the queried object is part of a Threat Prevention Exception Group.

PRJ-62092,

PRHF-40268

Security Management

In SmartConsole, when viewing the License tab of a Security Gateway object, multiple duplicated VSEC licenses with the same signature may be shown.

PRJ-60677,

PMTR-114726

Security Management

The Management API commands "add-lsm-gateway" or "add-lsm-cluster" may report success even when IKE certificate creation fails.

PRJ-61532,

PRHF-39869

Security Management

In the Compliance view, when clicking the picker in the "Source" or "Destination" columns while creating a custom Firewall Best Practice, the network objects list shows "Loading" and loads slowly.

PRJ-60213,

PRHF-38893

Multi-Domain Security Management

In rare cases, Security Gateway licenses are not displayed in SmartUpdate when connected at the Multi-Domain Security Management level, despite being visible at the Domain level.

PRJ-62128,

PRHF-26970

Multi-Domain Security Management

Running the "mds_backup" command with the "-v" flag may fail with "setenv: Too many arguments" error.

PRJ-61929,

PMTR-105087

Logging

In some scenarios, exporting logs to a CSV file at the Multi-Domain Security Management level generates an incomplete file with empty lines, and a log_indexer core dump may be found on the Server.

PRJ-59193,

PRHF-38042

Logging

When viewing certain reports in SmartView, the "No data found" error may appear even when matching logs exist.

PRJ-58761,

PRHF-37638

Security Gateway

Incorrect bonds may be shown in the Data Plane when using MDPS and running the Gaia Clish command "show configuration bonding".

PRJ-60753,

PRHF-39368

Security Gateway

Non-HTTP connections may be incorrectly dropped because of a missing Host header when the Gateway operates as a proxy.

PRJ-61908,

PMTR-116366

Security Gateway

Missing cleanup when template connection creation fails prevents the system from exiting new connection context mode, causing subsequent connection operations to write incorrectly to the cache instead of the connection table.

PRJ-60899,

PRHF-39414

Security Gateway

Traffic is dropped with a"Matched Optimized Drop" message, although it is allowed by configurations in the Rule Base. Refer to sk183443.

PRJ-61059,

FMW-4633

Security Gateway

VSEC licenses may be automatically deleted and re-added on the Security Management Server (SmartCenter in Azure), creating duplicate license strings with mismatched signatures and causing intermittent "License with CK already exists" errors.

PRJ-61864,

PRHF-40249

Security Gateway

In rare scenarios, the WSDNS daemon may exit instead of shutting down gracefully.

PRJ-57281,

PRHF-36273

Security Gateway

The $CPDIR/bin/update_license_conf script incorrectly parses the allowed cores count, setting "ALLOWED_CORES=-1" and causing Check Point Virtual Machine system corruption and daemon failures when CPU increases.

PRJ-62106,

PRHF-40509

Security Gateway

The Clone Policy Package task in SmartConsole fails with the "The object name must not contain whitespace characters at the beginning or the end" error. Refer to sk161294.

PRJ-60756,

PMTR-114362

Security Gateway

In rare scenarios, the local connection route may be incorrect when the ICAP client is active.

PRJ-55960,

PMTR-105446

Security Gateway

Maestro Security Group Member status frequently changes to "Down". The $FWDIR/log/fwk.elg file contains the error "h_iterate: invalid return value from callback". Refer to sk184887.

PRJ-59649,

PMTR-116831

Security Gateway

In rare scenarios, the FWK process may unexpectedly exit when stopping the Security Gateway with the "cpstop" command while a packet capture tool is running.

PRJ-51593,

PRHF-31491

Security Gateway

Unexpected cluster flapping may occur during signature load.

PRJ-62120,

PRHF-40597

Security Gateway

The SAML authentication flow may fail on a VSX Gateway.

PRJ-61362

Security Gateway

The Security Gateway may not be stable, and the error is printed in logs "Error: Timeout waiting for response from database server. BUG: soft lock - CPU#XX stuck for XXs". Refer to sk184554.

PRJ-62372,

PMTR-117120

Security Gateway

The Security Gateway may crash when checking if a local outbound packet's interface is excluded from outbound traffic processing while SecureXL User Mode (UPPAK) is enabled.

PRJ-61011,

PRHF-39339

Security Gateway

After upgrading the Security Gateway to R81.20 Jumbo Hotfix Accumulator Take 92, Remote Access IPSec VPN connections using Endpoint Security VPN E88.60 fail. Authentication succeeds, but all client connections through the Security Gateway are dropped by the Cleanup Rule.

PRJ-61488,

PRHF-39983

Security Gateway

In a rare scenario, the FWK process may restart unexpectedly.

PRJ-61052,

PRHF-39655

Security Gateway

After a system restarts (for example, reboot or cprestart), FWD-related sub-processes such as VPND and PDP may not run. Refer to sk183446.

PRJ-47010,

PRHF-28783

Content Awareness

Disk space may not be cleared as expected when Content Awareness is the only enabled Software Blade.

PRJ-62791,

PMTR-115931

URL Filtering

The FW_FULL process may exit in the Dynamic URLs list update flow.

PRJ-62256,

PMTR-116639

URL Filtering

In rare scenarios, the FWK process may crash when the URL Filtering Software Blade is enabled.

PRJ-62442,

PRHF-40727

IPS

Security Gateway blocks the download of files larger than 4 GB with the log "Application Control - HTTP parsing error occurred" in SmartConsole. Refer to sk183681.

PRJ-60270,

PMTR-113602

DLP

A potential memory leak because of many DLP/FILE_CONVERT processes spawned.

PRJ-57444,

PRHF-36348

ClusterXL

Virtual System in a VSX VSLS Cluster does not fail over when a cluster interface goes down. Refer to sk182734.

PRJ-62144,

PMTR-116446

SecureXL

After an upgrade, the USIM process may exit.

PRJ-63033,

PRHF-41230

SecureXL

When there are a large number of SNDs operating with Intel NICs, the system may run low on available jumbo mbufs, leading to connectivity issues. Refer to sk183771.

See Critical Information for R81.20 Jumbo Hotfix Accumulator.

PRJ-62690,

PMTR-117113

SecureXL

When the Security Gateway runs in User Mode SecureXL (UPPAK), removing a VLAN impacts connectivity on other VLANs in Bridge mode that share the same physical interface.

PRJ-59179,

PRHF-37771

Routing

The multicast stream may not resolve correctly in VSX topologies. Packets are dropped with the "IP multicast routing failed (missing OS route)" message.

PRJ-59304,

PMTR-111436

VPN

IKE related core files may be generated when passing traffic through a VPN tunnel.

PRJ-60074,

AAD-5014

VPN

Rare VPN connectivity issues caused by Encryption Domain overrides in communities with third-party Gateways.

PRJ-61968,

PRHF-40481

VPN

The VPND or IKED daemon may exit during IKEv2 negotiation.

PRJ-59921,

PRHF-38669

Gaia OS

In rare scenarios, users may be disconnected from SmartConsole, and an FWM process core dump is generated.

PRJ-61755,

PMTR-115846

Gaia OS

Traffic routing may fail between the host and PPPoE / DNS Server through the Security Gateway, even though host-to-gateway and gateway-to-DNS connections work as expected.

PRJ-61813,

PRHF-40409

Gaia OS

SNMP Agent may report a wrong value for VLAN Interface Speed.

PRJ-59656,

PRHF-38449

Gaia OS

The 1.3.6.1.4.1.2620.1.6.7.5.1.5 SNMP OID (multiProcUsage) reports wrong values when HyperFlow is enabled.

PRJ-61193,

PRJ-61194

Gaia OS

The output of "cppcap" command (sk141412) with the "-i" flag prints "Failed to capture X packets".

PRJ-62383,

PRHF-40893

Gaia OS

SNMP data types in the "asg" MIB tree (for Scalable Platform Security Groups) may be incorrect.

PRJ-62115,

PRHF-40601

Gaia OS

Backup retention policy on Maestro may be performed only on SMO and skip a Security Group member.

PRJ-58020,

PRHF-36770

Gaia OS

Backup may fail when using some special characters in the Remote Security Manager Server password.

PRJ-61592,

PRHF-40115

Gaia OS

• The sysLocation OID (1.3.6.1.2.1.1.6.0) returns "UNKNOWN", even though the value is configured in the SNMP settings and exists in the Gaia database (/config/active).

• When editing sysLocation or sysContact using the SNMP configuration interface, the Gaia database is updated, but the SNMP configuration file is not updated.

PRJ-62221,

PRHF-40517

CloudGuard Network

If the User Center connection fails, contracts may be retrieved incorrectly, resulting in erroneous contracts getting pushed to the Security Gateway.

PRJ-61979,

PRHF-40203

CloudGuard Network

Changes made to the JSON file of a Generic Data Center object may take a long time to appear in SmartConsole or the Management API, although enforcement on the Security Gateway functions as expected.

PRJ-59779,

PMTR-111817

Scalable Platforms

Policy installation may fail on newly added Security Group members because an updatable object package is missing.

PRJ-60102,

PRHF-38839

Scalable Platforms

The "g_perf" command fails with both IPv4 and IPv6 data on the Maestro Security Group when IPv6 is enabled.

PRJ-61344,

PRHF-39863

Scalable Platforms

The "asg diag verify" command reports inconsistent OSPFv3 routes on Maestro Security Group Members. Refer to sk179931.