R81.20 Jumbo Hotfix Take 158

NEW: Added a configuration option for Maestro Orchestrator to forward Spanning Tree Protocol (STP) BPDUs to Maestro Security Group Members. Refer to sk185110.

UPDATE: Resolved CVE-2026-62145 - Local privilege escalation in Gaia Portal. Refer to sk185153.

UPDATE: Resolved CVE-2026-16232 - Authentication bypass with SmartConsole login process using application token. Refer to sk185169.

UPDATE: Added Take 89 and Take 90 of the AutoUpdater Utility. Refer to sk165653.

UPDATE: Added Take 65 and Take 70 of Log Exporter Auto Update Deployment. Refer to sk182866.

UPDATE: Added Take 13 and Take 75 of Smart-1 Cloud MaaS Tunnel. Refer to sk166056.

UPDATE: Added Take 57 and Take 59 of CPquid (QUID) Release Updates. Refer to sk181458.

UPDATE: Added Take 94 of HealthCheck Point (HCP) Release. Refer to sk171436

UPDATE: JRE is updated from version 8.0_8.50 to version 8.0_8.60.

UPDATE: On the Exporter Rates tab in CPView, the Log Exporter configuration name length limit is now increased from 15 characters to 25 characters. This resolves the issue when the configuration name may appear blank if it exceeds the length limit.

UPDATE: In the Logs view, search performance is improved when the search term includes a Cluster.

UPDATE: Optimized Mobile Access policy installation to improve performance in environments with a large Mobile Access Rule Base (more than 500 rules).

UPDATE: Added the "tap_mode" parameter to a dispatcher (fwmultik_dispatcher_in_tap_mode). This parameter puts the multi-core dispatcher into the Tap Mode for inbound traffic. Refer to sk184455.

UPDATE: Resolved the Mobile Access Portal XSS vulnerability in the PHP file.

UPDATE: Gaia API updates are now included in the Jumbo Hotfix Accumulator (previously were installed by AutoUpdater). See sk143612.

UPDATE: Old SVMAC feature is now deprecated ("toggle_same_vmac" parameter is blocked). Only use the new SVMAC feature ("toggle_same_vmac_os"). Refer to sk165674.

UPDATE Global parameter "fwha_grade_should_consider_lacp" is now disabled by default.

UPDATE: "asg_route" tests is now removed from the "asg_diag" command options.

In the VLAN interface, CPView shows the speed of the parent.

In rare scenarios, the FWM process on the Multi-Domain Security Management Server may not stop after running mdsstop.

The delay may be observed during the "compiling policy" and "generating policy files" stages in SmartConsole.

In some scenarios, the automatic update of Data Center assets fails. Refer to sk184316

In some scenarios, after the FWM process crashes and generates a core dump, High Availability synchronization may fail, and the Security Management Servers may appear as disconnected.

In some scenarios, opening a Security Gateway object in SmartConsole fails with "Smart Dashboard component failed to connect to a server".

If the "Revert to Revision" operation fails:

• Login to the Security Management Server may fail with timeout.

• Publish operations may take a long time.

In some scenarios, the Security Management Server may generate excessive log messages, causing the cpm.elg log file to reach its size limit quickly.

In rare scenarios, some Management API commands may fail with "Management server failed to execute command" error. 

In some scenarios, running the "api stats" command with the "-calc_avg_duration" flag on the Security Management Server fails with the "IndexError: list index out of range" error. Refer to sk184144.

In SmartTask-generated emails, the Sender field displays the username instead of the user's email address.

In some scenarios, the FWM process on the Security Management Server may unexpectedly exit when performing the "Fetch branches" action in the LDAP Account Unit properties window of SmartConsole.

SmartConsole may display the error "the user already exists" when attempting to create a new administrator with the same name as a previously deleted SAML (Identity Provider) administrator.

If the MGMTCOMP-DIFF-REPORT-CLIENT process becomes suspended on the Security Management Server, the Server-side Change Report Generator fails to generate and send reports when processing a large number of changes.

In some scenarios, the status of a Security Gateway is incorrectly displayed in the Gateways & Servers View.

The Security Management Server upgrade may fail during the export phase with the "Object not found - Entities can not be found" message.

SmartWorkflow may incorrectly show zero changes for a session, preventing the change report from being displayed. Refer to sk184779.

In some scenarios, the "show-simple-clusters" Management API command with details-level set to "full" may fail with the error message "Configuration Sharing Failed to update Infinity Portal".

Security Gateway license information may not be visible in SmartConsole when using Demo mode or when connecting with a read‑only user.

A temporary fix related to the QUID identity database (used by CPDiag and AIOps) caused issues in Maestro environments and led to degradation and occasional agent resets in AIOps, as it relies on this component as its IdentityDB. The fix has therefore been removed.

In HTTPS Inspection logs, some log entries may incorrectly display "Log Update" in the Software Blade field.

In some scenarios, non-ASCII characters may appear garbled in SmartEvent Automatic Reaction emails.

In some scenarios, the SmartLog Server process may unexpectedly exit and generate a core dump.

In some scenarios, the LOG_INDEXER process unexpectedly exits and generates a core dump.

In SmartView Monitor, opened from the Logs & Events > Tunnel & User Monitoring view, the "SmartEvent Correlation Unit" status may be displayed as "Not running" although the CPSEMD process is running.

In the "HTTPS Inspection Statistics" in SmartView, filtering by the "bypass_reason" field returns no results.

In a rare scenario, the FWK process crashes when the Mirror and Decrypt feature handles large MTU frames.

Legitimate files may be incorrectly flagged as malicious when scanned with ICAP. Refer to sk184628.

In rare scenarios, when deleting a subordinate interface from a bonding group, the FWK process may exit. Refer to sk183736.

When ISP Redundancy is enabled, and the administrator changes the priority, the primary ISP may not be updated in the Security Gateway (the route is updated, but the Security Gateway continues to consider the old ISP as the primary/standby). Refer to sk184923.

In cluster configurations, synchronization between members was optimized to reduce CPU overhead.

First packet may be delayed for around 10 seconds because of pending WSDNSD DNS lookup over TCP. Refer to sk184096.

Active Streaming Layer connections become stuck, resulting in increased memory consumption over time on the Security Gateway. 

Suspicious Activity Monitoring (SAM) rules may not function properly on a standalone device. Refer to sk184330.

In a rare scenario, the FWD daemon may restart because of the Application Control Dynamic URL List version file.

In some scenarios related to Check Point Active Streaming (CPAS), the Security Gateway may unexpectedly crash.

Some service ports may be missing in some instances, resulting in unexpected behavior for some services.

The RAD daemon may unexpectedly exit when customizing RAD internal parameters ("max_flows" and "queu_max_capacity"). Refer to sk182136

In rare scenarios, the FWK process may unexpectedly restart when an HTTP/2 connection containing specific stream characteristics is released.

In a rare HTTP/2 traffic scenario, a valid connection may fail.

In a rare scenario, the FWD process may crash during Policy Installation because of memory corruption related to licensing.

RSH connections fail when Destination NAT is configured for the RSH server. Refer to sk184768.

In a rare scenario, a memory leak may occur due to a race condition between policy installation and Application Control/IPS signature updates, and persists until the next policy installation.

In a rare scenario, an incorrect zone assignment occurs when NAT Rule Base returns HOLD. Refer to sk184530.

When ESP traffic is present in the environment, and the fwmultik_dispatcher_in_tap_mode parameter is enabled, the Security Gateway may drop ESP traffic.

In some rare scenarios, when HyperFlow is enabled, HTTPS traffic fails when processed in the accelerated pipelined path. Websites going through SSL Inspection may take a long time to load or parts of the website may not load.

HTTPS inspection causes connections to fail when using a custom service with a non-standard HTTPS port (for example, TCP/9400), and the custom service object is configured with "Protocol: None". Refer to sk184294.

Connections handled by CPAS may stop forwarding data upon receiving a FIN from one side. As a result, a file download fails.

SSH connections may fail after enabling SSH Deep Packet Inspection (DPI).

IoC feed observables may continue to be enforced even after Anti-Virus and Anti-Bot are disabled.

In rare scenarios, the Anti-Virus fails to inspect HTTP file downloads.

The Microsoft Graph API access token does not renew if an authorization error occurs while working in on-demand fetch mode.

The default role in Aruba Networks ClearPass CPPM does not match the identity sessions.

In a rare scenario, there may be no access to resources for identities received from the Remote Access identity source.

SNMP queries to the Security Gateway may return unexpected results: specific IP addresses or Identity Collector objects may continue to appear in SNMP outputs even after being removed from the topology configuration. Additionally, polling OIDs such as 1.3.6.1.4.1.2620.1.38.55 or 1.3.6.1.4.1.2620.1.38.53 may result in the message "No Such Instance currently exists at this OID"

Updating two or more Dynamic URL Lists may result in partial updates.

In a rare scenario, when using Dynamic URL List, updating the version file may result in a FWK process restart.

In some scenarios, the Custom Threat Prevention policy fails to enforce IPS protection overrides on rules configured with a network group in the "Install On" column.

In rare scenarios, the RAD process may exit generating a core dump.

When Mobile Access is working in Path Translation (PT) Link Translation mode, the Citrix application may not load after an upgrade to Citrix version LTSR 2507

Connections with fragmented packets drop on Scalable Platform/Maestro when there are multiple active Security Group Members (SGMs) on the site. Refer to sk182559.

In rare scenarios, CPHASTART, CPHACONF, and CPHAMCSET processes may intermittently unexpectedly exit.

In some scenarios, the USIM process may unexpectedly exit.

In a Cloud Firewall environment with Kernel Performance Pack (KPPAK) enabled by default, when modifying the TX queue size parameter for supported network interfaces to 2048 (2K) or 4096 (4K), reverting the setting back to the default value of 1024 (1K) is not possible.

The issue is observed with these synthetic network drivers: virtio (used in GCP and KVM environments), vmxnet3 (used in VMware ESXi), and ena (used in AWS).

Added logic to forbid IP forwarding at startup if the deny list/rate limit policy installation fails.

The "arping" command on the Security Gateway returns this output "Sent 4 probes Received 0 response" in SecureXL User Mode (UPPAK). Refer to sk184292.

When VLAN interfaces are created on top of bond interfaces configured for Load Sharing, connections may not be hardware accelerated if the bond uses multiple ports from the same physical NIC. Refer to sk184291.

When using DoS Deny List and running "cpstop", an error message may be displayed, and a memory leak may occur.

In some scenarios, VPN clients establish the tunnel in Visitor Mode instead of NAT-T.

In some scenarios in a VSX Maestro Security Group, when SecureXL User Mode (UPPAK) is enabled, a cluster member may incorrectly forward traffic through a Warp interface to the incorrect Virtual System. This results in traffic not being processed by the intended Virtual System, potentially causing "Out of State" drops.

In some scenarios, when installing a policy fails, the Sand Blast Security Gateway becomes unresponsive and reboots automatically. The "Installation failed. Reason: Due to a timeout value of 600000 (millisecond) (port) (IP), Security Management Server aborted the connection with the peer" error is displayed in SmartConsole.

Permanently disabling the "cphwd_enable_ecmp" global parameter on a VSX Gateway using the "-f" option of the "fwl ctl set" command may fail.

PPTP/GRE traffic fails when Hide NAT is used and SecureXL runs in UPPAK mode and the "fw_pptp_enforce_protocol" parameter is enabled. Refer to sk184641.

In some scenarios, an error occurs in UPPAK mode when packets are cloned. This can lead to random crashes in the USIM process, causing instability during interface changes or high traffic.

In some scenarios in UPPAK mode, the nexthops may be incorrectly indexed, which leads to packet drops.

The ROUTED daemon may exit when running the "show bgp paths" command.

A VSX Security Gateway may drop traffic with IPv4 options or IPv6 extension headers arriving from a Virtual Switch (VSW) interface.

When adding or deleting static routes in the huge VSX environment (more than 50 Virtual Systems and hundreds of static routes), VS creation fails with "Unable to watch directory /etc/routed-mc-enable: init: Too many open files". Refer to sk181317.

In some scenarios, the CPView utility causes high CPU usage or becomes stuck while calculating disk space.

A snapshot created via the Gaia Portal is deleted immediately upon creation. Once this occurs, the operation cannot be retried. Orphaned lock files block all subsequent attempts. The error "Snapshot: Failed to take snapshot. Another backup / snapshot is currently in execution. Please try again in a few moments" is printed in the logs. Manual deletion of the lock files is required to restore functionality. Applying the workaround from sk100403 does not provide a permanent resolution, and the issue recurs.

The "config_verify" command or the HCP configuration sync validation incorrectly fails because of a fwkern.conf file mismatch between the Security Group members.

Custom log rotation configured using Gaia OS does not apply to UserCheck Portal log files, so these logs are not rotated automatically. Refer to sk113241.

After an upgrade, in some scenarios, two-factor authentication (2FA) may not be enforced for SSH access. This results in users are able to authenticate via SSH without the required 2FA.

Unable to enter Virtual System with "virtual-system-access all" configured. Refer to sk184282.

Remote and local backup operations fail after installation of Jumbo Hotfix Accumulator with the "Cannot complete the backup process: not enough space in /var/log/CPbackup/backups" error. Refer to sk183767.

Newly added SGM remains "Down" on Scalable Chassis with SSM440 configured with MTU higher than 9000. Refer to sk184653.

Clish may restart unexpectedly when running the set snapshot-onetime command.

Upon logging in to the Gaia Portal, the login page accepts the credentials, briefly displays the homepage, and then automatically redirects back to the login screen.

Multiple "login_notifier_server: before force_2fa_generation, params: 2fa-check" messages appear in the /var/log/messages file. The issue is cosmetic. Refer to sk183690.

For IDNS-Resolver, when the DNS server returns "TC=1", and communication should be moved to TCP instead of UDP, TCP communication does not block DNS requests.

In some scenarios, SNMP monitoring may incorrectly report 100% CPU usage. 

IKE daemons may fail to start on Cluster members without generating dump files.

Added the ability to import additional .p12 certificate types as inbound and outbound certificates.

Improved input validation in the VPN L2TP PPP packet parser to handle malformed configuration options correctly.

In some scenarios, over time, prolonged VPN traffic may lead to gradual memory growth.

During VPN IKEv2 negotiations with third-party peers that offer multiple combined encryption algorithms (both AES-GCM-128 and AES-GCM-256), the Security Gateway may not properly match the proposal, resulting in IKE failure logs and the tunnel establishment failure.

When using Capsule VPN or Endpoint Security VPN (Connect) clients in IPsec mode with IKED enabled, users can successfully authenticate and establish a VPN tunnel. However, group information received from the RADIUS server is not passed to the IKED process. As a result, security policies and access roles that rely on RADIUS group membership do not apply, and users are unable to access internal resources through the VPN.

When generating a CPInfo file using the CPInfo utility, major CPU spikes may occur on the Security Gateway or Security Management Server.

A VPN tunnel may fail to establish in ClusterXL Load Sharing Mode during cluster member failover (pivot recovery).

CRL files may not be synchronized as expected in Management High Availability and Multi-Domain Security Management environments.

Improved SSL Network Extender (SNX) certificate-based authentication stability and session reliability.

On the Scalable Platform Cluster, LS fragmented packets may be dropped on the receiving member with an error "handle_sim_inbound_frag: error (2): frag freed, ret_val (11): FRAG_ERROR_MSG_DUPLICATE in fragment" on a loaded environment with a lot of corrected fragmented packets.

This may also occur with Cluster HA; however, correcting packets is negligible in such environments.

VPN traffic outage may occur in ClusterXL environments after a Cluster failover.

In rare scenarios, SD-WAN objects (such as Peer VPN Domain, My VPN Domain, or SD-WAN Internet) may be incomplete, causing SD-WAN rules to match traffic incorrectly.

Moving Cloud licenses from one pool to another triggers license alignment: If adding a new license to CK fails, license removal will not be initiated on the Security Gateways.

Deleting a license pool while Cloud Firewall Gateways are still associated with it causes all licensing operations (add, distribute, remove) to continuously fail until the orphaned reference is manually cleared from the database.
The fix allows licensing operations to complete normally without administrator intervention.

Gaia Portal and Gaia gClish of a Maestro Security Group do not show newly created Loopback interfaces.

The command "set backup restore ftp" executed in gClish is applied only to the SMO member and not to all Security Group members.

The HCP configuration sync verifier ("config_verify") incorrectly reports a failure because the asg_diag_file.dat file is not synced between members.

When performing a SIC reset after Anti-Malware (AMW) has been installed, some members may enter a "cluster-down" state with an AMW Critical Device.

When running the "show asset all" command on setups with ElasticXL enabled, Disk Model, Serial, and Capacity outputs are not displayed.

On Maestro appliances, /var/log/messages may be flooded with "asg_copy_capture" error messages when the system attempts to retrieve packet capture files that do not exist on remote Security Group members.

The SGM400 chassis member uses an incorrect backplane Ethernet (BPEth) drive, causing backplane traffic not to be processed on that member.

Rebooting an Active member in the Single Management Object (SMO) role may trigger a brief connectivity loss.

After creating a bridge interface using Gaia Portal and rebooting, the Security Gateway state is Down.

In Maestro or ElasticXL environments with VPN enabled, traffic may be dropped with the log message "fwha_select_should_drop_vmac".

Intermittent VS failover when both Maestro Hyperscale Orchestrators (MHOs) have the interface link state set to Down. Refer to sk184568.

In VSLS clusters with multiple members, when a member rejoins the cluster after a reboot, an Interface Active Check (IAC) problem notification may incorrectly appear on the rejoining member, showing it in ACTIVE state. This occurs even though all interfaces are physically UP and the cluster is fully functional.

• When a large number of bond interfaces are configured, the synchronization of link states may fail.

• In rare scenarios, a cluster member may become stuck in the "active (sync)" state. When this occurs, the affected member does not handle network traffic as expected.

• There may be inconsistencies in the reported link state across Security Group Members (SGMs), as observed with the "asg stat -v" command.

A "Tunnel established" message may be printed for rejected sessions. The issue is cosmetic.

GTP-U intra-tunnel packets may be dropped with "Packet too short" and "Invalid IP packet" errors in Bridge Mode, preventing proper inspection of encapsulated traffic.