R81.20 Jumbo Hotfix Take 166

Take 166 - New Functionality

PRJ-70075,

PMTR-129515

Security Management

NEW:Introducing the "show-ad-content" Management API, which enables the retrieval of users, groups, and machines from Active Directory.

Take 166 - Improvements and Resolved Issues

PRJ-71614,

ODU-4598,

PRJ-71130,

ODU-4470

Automatic Updates - Web SmartConsole

UPDATE: New features and improvements are released in Take 177 and Take 178 of Web SmartConsole. Refer to sk170314.

PRJ-71255,

ODU-4492

Automatic Updates - HCP

UPDATE: Added Take 95 of HealthCheck Point (HCP) Release Updates. Refer to sk171436.

PRJ-68590,

PMTR-127145

Automatic Updates - HCP

UPDATE: The HCP configuration sync verifier (the config_verify command) may incorrectly indicate a mismatch in the $FWDIR/boot/modules/fwkern.conf file due to differences in the line order between members.

PRJ-71382,

ODU-4591,

PRJ-71259,

ODU-4477

Automatic Updates - Policy Insights

UPDATE: Added Take 97 and Take 98 of Policy Insights Release Updates. Refer to sk183421.

PRJ-71266,

ODU-4463

Automatic Updates - CloudGuard Network

UPDATE: Added Take 38 of CloudGuard Controller Release Updates. Refer to sk181842.

PRJ-71264,

ODU-4484

Automatic Updates - CloudGuard Network

UPDATE: Added Take 325 of CME (Cloud Management Extension) Release Updates. Refer to sk157492.

PRJ-60266,

PRHF-38897

Gaia OS

UPDATE: Gaia Cloning Group synchronization (port 1129) now uses updated and more secure SSL/TLS versions for internal communication. Refer to sk182091.

PRJ-69074,

PRHF-45246

Gaia OS

UPDATE: Added support for passwords containing the ampersand "&" character, which previously caused failures in scheduled backup operations.

PRJ-62162,

PRHF-40230

VPN

UPDATE: Added support for treating trusted CA certificates with non-compliant attributes as valid. This includes certificates with incorrect Key Usage settings or missing Basic Constraints, based on customer-defined configurations. Refer to sk183800.

PRJ-71486,

PMTR-131442

VPN

UPDATE: Resolved CVE-2026-85102 - Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN. Refer to sk1000117.

PRJ-71552,

PMTR-131527

VPN

UPDATE: Resolved CVE-2026-85103 - ASN.1 decoding heap overflow leading to a remote code execution. Refer to sk1000118.

PRJ-70386,

PMTR-129271

Security Management

SmartConsole may display a "No communication" error message caused by a file descriptor leak in the FWMHA process after prolonged uptime.

PRJ-67754,

PRHF-44852

Security Management

Policy installation may fail when custom authentication *.ttm files are not included during policy package preparation, resulting in a "No such file or directory" error message.

PRJ-67494,

PRHF-44700

Security Management

In rare scenarios, the accumulation of large API request-status files could cause Security Management Server slowness.

PRJ-58526,

PRHF-37141

Security Management

In some scenarios, policy state directories are synced between active and standby Security Management Servers causing high disk space utilization.

PRJ-63510,

PRHF-41422

Security Management

The "mds_restore" command may not restore audit logs at the MDS level.

PRJ-67852,

PRHF-45034

Security Management

In rare scenarios, login to SmartConsole may fail due to a timeout.

PRJ-67759,

PRHF-44799

Security Management

Improved debug logging in the $FWDIR/log/cpm.elg file during upgrades of a Multi-Domain Security Management Server.

PRJ-62522,

PRHF-40980

Security Management

On a Multi-Domain Security Management Server, the "api stats-group-by-domain" command may report all requests as "unknown domain" instead of categorizing them per domain. Refer to sk183892.

PRJ-66785,

PRHF-43884

Security Management

In SmartConsole, a network object that is no longer referenced by any policy may fail to be deleted with an "object is being used" error message.

PRJ-67762,

PRHF-44772

Security Management

In rare scenarios, deleting a Secondary Security Management Server fails because it references objects that no longer exist.

PRJ-69863,

PRHF-45625

Security Management

When one administrator installs a policy, other logged-in administrators may see an "Error retrieving results" message in the Tasks window instead of the policy installation progress.

PRJ-69860,

PRHF-46038

Security Management

Administrators logging into SmartConsole with certificate authentication at the MDS level using the "\MDS" format may unexpectedly receive read-only permissions instead of the expected read-write access.

PRJ-70232,

PRHF-45998

Security Management

In some scenarios, when a Multi-Domain Security Management Server is connected to the Check Point Portal, a connectivity failure warning for the Global SmartEvent server may appear, even though Global SmartEvent servers are not supported in the Check Point Portal.

PRJ-67612,

PRHF-44583

Security Management

In a Management High Availability environment, the statuses of clusters and cluster members may be displayed incorrectly on the secondary Security Management Server.

PRJ-67413,

PMTR-125556

Security Management

The Management Rest API show-global-properties fails when there is a database inconsistency for the 'keep-hit-count-data-up-to' field.

PRJ-67811,

PMTR-126383

Security Management

Disk space on the Security Management Server may become depleted due to the excessive growth of internal PostgreSQL database tables.

PRJ-69441,

PRHF-45656

Security Management

Accelerated policy installation may be skipped if Compliance generates a high number of audit log entries between sessions.

PRJ-67775,

PMTR-126316

Security Management

Snort IPS protections are not downloaded to the local domain during Global Policy Assignment.

PRJ-69186,

PRHF-45542

Security Management

When generating a Show Changes PDF report for a workflow or session, the report could include internal system changes, such as IPS protection changes, that were not performed by the user.

PRJ-68286,

PRHF-44951

Security Management

Policy objects may fail to open in Web SmartConsole with a "Something went wrong" error message.

PRJ-70411,

PRHF-46322

Security Management

In an environment with multiple Multi-Domain Security Management (MDS) Servers, High Availability synchronization between MDSs may intermittently fail with the "NGM failed to import data" error message because of missing VSEC license objects in the secondary MDS database.

PRJ-60815,

PRHF-39436

Multi-Domain Management

When logging in to SmartUpdate on a Multi-Domain Security Management Server, domain licenses may not appear in the Domain Licenses view.

PRJ-68525,

PRHF-45066

SmartProvisioning

When running the LSMcli AddROBO command with the -S (SubstitutedNamePart) parameter, the cluster profile name suffix may not be substituted correctly.

PRJ-58114,

PMTR-129439

Logging

UPDATE: Added support for displaying the Member ID field in the Logs view through Edit Profile > Columns Profiles.

PRJ-67344,

PRHF-44310

Logging

In rare scenarios, the LOG_INDEXER process may crash unexpectedly due to improper memory handling.

PRJ-69985,

PRHF-46185

Logging

When viewing logs in the Check Point Portal, a "Query failed" error message may intermittently appear for several minutes.

PRJ-68883,

PRHF-45417

Logging

Exporting logs that contain "ampersand" in their fields to a CSV file via SmartView web application may fail with a "Failed to export" error message.

PRJ-57166,

PRHF-36102

Logging

When viewing Forensics Reports in SmartView through the Check Point Portal, non-ASCII characters may appear distorted.

PRJ-69245,

PRHF-45525

Logging

When right-clicking the "*_interface" field in the SmartView Logs web view and selecting Add as Filter, the query may fail, resulting in no logs being displayed.

PRJ-61606,

PRHF-40126

Security Gateway

Custom trap for BGP isn't working on MDPS when BGP is configured in data plane.

PRJ-47870,

PRHF-29668

Security Gateway

In rare scenarios, when processing TLS traffic and attempting to return an error page, the FWK process may crash.

PRJ-66834,

PRHF-43754

Security Gateway

In some scenarios, CPView may display an incorrect value for CPU user time. Refer to sk184722.

PRJ-67914,

PRHF-41891

Security Gateway

In some scenarios, the Security Gateway may not close connections properly when a device stops responding during an active download, leading to a gradual memory leak over time.

PRJ-67800,

PRHF-45012

Security Gateway

When a user configures NAT to convert a connection's destination IP address from unicast to multicast, the Security Gateway may transmit packets with an incorrect MAC address when SecureXL is enabled.

PRJ-69499,

PRHF-40443

Security Gateway

In some cases, an ICAP server closing the connection to an ICAP client with an RST may cause an FWK process crash.

PRJ-58566,

PRHF-26696

Security Gateway

In some cases, the Captive Portal fails to authenticate users when SAML authentication is enabled.

PRJ-64877,

SMBGWY-16234

Security Gateway

Improved connectivity for LSV peer traffic after an ISP failover.

PRJ-62559,

PRHF-40560

Security Gateway

Enhanced stability when manual edits to the fwkern.conf file result in a malformed configuration. To manage the file, it is recommended to use the -f option of the fw ctl set command, as detailed in sk26202.

Refer to sk184081.

PRJ-66264,

PRHF-43044

Security Gateway

The FWK process may restart unexpectedly due to improper handling of a connection.

PRJ-69101,

PRHF-45611

Security Gateway

The RAD daemon may unexpectedly exit on VSX Gateways.

PRJ-66555,

PRHF-43835

Security Gateway

In rare scenarios, a Security Gateway may crash when LSP (Link State Propagation) is enabled.

PRJ-66298,

PRHF-43833

Security Gateway

The FWK process may unexpectedly restart because of an incorrect integration with CPView.

PRJ-67538,

PRHF-44757

Security Gateway

In some scenarios, multicast traffic and a race condition during route lookup may lead to a crash in the Security Gateway.

PRJ-65676,

SWSCFG-654

Security Gateway

The PDPD daemon may encounter high CPU utilization when Nested Groups query method 5 (query by SIDs) is in use. Refer to sk183748.

PRJ-67416,

PMTR-124725

Security Gateway

In some scenarios, the ICAP Server may crash because of memory issues.

PRJ-71457,

PRHF-47521

Security Gateway

In some scenarios, users can connect to Mobile Access/SSL Network Extender, but do not have access to internal resources after upgrading. Refer to sk185260.

PRJ-69204,

PRHF-45101

Security Gateway

In some scenarios, Spike Detective file descriptors may remain undeleted.

PRJ-70510,

PMTR-130005

Threat Prevention

In certain scenarios, the Security Gateway may fail to apply a new GeoIP database update.

PRJ-69947,

PRHF-46128

Threat Prevention

The Anti-Virus may fail to load external IOC feeds that contain URL-type observables.

PRJ-65679,

PRHF-43309

Threat Emulation

Files without extensions were receiving a Scan Pass verdict from the ICAP server. As a result, malicious files without extensions were also assigned a Scan Pass verdict, which ultimately led to a Benign classification.

PRJ-55782,

PRHF-34201

Identity Awareness

In some scenarios, errors in rule number calculation prevented packet tagging from working.

PRJ-69215,

PRHF-39546

Identity Awareness

Improved handling of duplicate Identity Collector events on the PDP Security Gateway.

PRJ-65132,

PRHF-42745

URL Filtering

An HTTPS Inspection rule that contains a custom application whose name includes spaces or certain unsupported characters does not match during policy enforcement. Refer to sk184773.

PRJ-64167,

PMTR-118916

IPS

Enforced compliance with the HTTP RFC by requiring a "/" in the request path for non-proxy HTTP connections, except for the CONNECT and OPTIONS methods. Traffic that does not meet this requirement will be dropped if "Non-Compliant HTTP" is set to "Drop" and "Strict Request Parsing" is enabled.

PRJ-67473,

PRHF-44623

SSL Inspection

In some scenarios, a memory leak may occur in the WSTLSD process when it fails to decode a certificate.

PRJ-67476,

PRHF-44630

SSL Inspection

Certificate validation may fail for certificates containing an ASN.1 NumericString in the X.509 Subject attribute.

PRJ-66072,

PRHF-43570

SecureXL

In rare scenarios, a performance issue may occur when a policy is installed on multiple Virtual Systems simultaneously. Refer to sk184585.

PRJ-55338,

PRHF-33964

SecureXL

In some scenarios, the Security Gateway may not properly remove closed TCP connections, processed through Active Streaming, from its accelerated connections table if a new security policy was installed beforehand.

PRJ-67116,

PMTR-120253

SecureXL

In some scenarios, the VSX Gateway may experience significant latency when passing traffic between Virtual Systems through a Virtual Router.

PRJ-67268,

PMTR-125173

SecureXL

In some scenarios, the Security Gateway may restart unexpectedly when passing traffic through LightSpeed hardware acceleration interfaces with SecureXL User Mode enabled.

PRJ-70357,

PMTR-127257

SecureXL

In some scenarios, the VSX Gateway may not properly assign CPUs to a Firewall instance or SND after booting up when SecureXL User Mode is enabled.

PRJ-70343,

PRHF-46357

SecureXL

In some scenarios, VLAN tags are stripped and MAC addresses become malformed after traffic passes through the bridge. Refer to sk185101.

PRJ-67771,

PMTR-119674

SecureXL

In some scenarios, the VSX Gateway may experience poor performance when passing traffic between Virtual Systems through a Virtual Switch with SecureXL User Mode enabled.

PRJ-70927,

PRHF-46835

SecureXL

In certain scenarios, the VSX Gateway may transmit packets with incorrect MAC addresses for cleartext connections when SecureXL is enabled, specifically when these packets are sent through a Virtual Router or Virtual Switch.

PRJ-66860,

PMTR-124252

SecureXL

In some scenarios, the VSX Gateway may unexpectedly restart when passing traffic through a Virtual Switch with SecureXL User Mode enabled.

PRJ-58856,

PMTR-110610

SecureXL

Multicast routes may not update or respond correctly to changes in the network.

PRJ-69942,

PMTR-127433

SecureXL

In some scenarios, VPN packets are dropped in User Mode (UPPAK) during encryption when QoS is active.

PRJ-70273,

PRHF-45730

SecureXL

A rare scenario handling Jumbo Frames of specific sizes on Intel-based NICs may trigger a driver internal protection (MDD) error, potentially impacting performance or connectivity.

PRJ-69551,

PRHF-45732

Gaia OS

Performance improvements have been made to the VSX interface configuration process.

PRJ-70122,

PRHF-45729

Gaia OS

When syslog messages are forwarded to the Security Management Server using the set syslog cplogs on command, they may be misclassified under an incorrect blade instead of Syslog. This misclassification can make it challenging to filter, correlate, and analyze the logs effectively.

PRJ-69253,

PMTR-126101

Gaia OS

In some scenarios, the Security Gateway may fail to access interface data correctly when SecureXL User Mode is enabled.

PRJ-66701,

PRHF-43888

Gaia OS

Duplicate interface configuration entries appear in the show configuration command output. Refer to sk184759.

PRJ-66894,

PRHF-44101

Gaia OS

In some scenarios, duplicate interface entries appear in the output of the "show configuration" Clish command.

PRJ-68604,

PRHF-44741

Gaia OS

In rare scenarios, the Security Gateway may unexpectedly crash due to timer corruption.

PRJ-71372,

PRHF-47549

Gaia OS

Two-Factor Authentication (2FA) configurations are now preserved during upgrades to a newer R81.20 Jumbo version.

PRJ-68555,

PRHF-44964

Gaia OS

Two-Factor Authentication (2FA) initial setup may not be triggered via the Gaia Portal on Scalable Platforms.

PRJ-71811,

PRJ-71815

Gaia OS

PRJ-58308,

PRHF-37219

Gaia OS

The lower bottom threshold for the PCH-Vin sensor on Check Point Firewall 9700 appliances was set incorrectly.

PRJ-69940,

ROUT-2627

Routing

The ROUTED process may crash when more than 250 interfaces are configured and then deleted.

PRJ-69977,

PRHF-45943

Routing

In some scenarios where the SPT cannot be set on an entry with the Decap bit enabled, the Decap bit is now reset to ensure that incoming Register packets can be processed.

PRJ-60408,

TPDO-4412

Routing

Certain standard IPv6 addresses may have been incorrectly identified as multicast addresses.

PRJ-68693,

PRHF-45292

Traditional VSX

In rare scenarios, a crash may occur in Traditional VSX during a call to kmem_cache_alloc.

PRJ-67298,

PRHF-44576

Mobile Access

The Mobile Access Blade portal may not function properly with web applications that set HTTP cookies containing the pipe ('|') character in their values.

PRJ-65401,

PMTR-122348

VPN

Improved stability for Permanent Tunnel functionality when using Tunnel Test UDP/18234 in Maestro environments.

PRJ-70688,

PRHF-46758

VPN

Capsule Connect / VPN users are unable to log in and receive the error message "Client's configuration is not verified". Refer to sk185144.

PRJ-66854,

PRHF-44039

VPN

vpnd keeps crashing after downgrading from R81.20 JHF 122 to R81.20 JHF 120

PRJ-69266,

PRHF-45001

VPN

In some scenarios, the VPN tunnel flaps every 40 seconds when the in-kernel tunnel test is enabled.

PRJ-70125,

PMTR-128909

VPN

Added Layer Two Tunneling Protocol (L2TP) stabilization improvement.

PRJ-66900,

PMTR-123203

VPN

EDPC tunnel establishment failure after MEP failover to a new Security Gateway.

PRJ-67858,

PRHF-44977

VPN

In rare scenarios between an LSM Central Gateway and an LSM Satellite Gateway, the Route Injection Mechanism (RIM) may not function correctly.

PRJ-70104,

PMTR-128918

VPN

Improved stability in VPN tunnel monitoring workflows.

PRJ-70113,

PMTR-128876

VPN

Improved stability and robustness in VPN session message handling during connection flows.

PRJ-70045,

PMTR-128892

VPN

Enhanced stability and reliability in IKEv2 certificate handling.

PRJ-70580,

PRHF-46735

VPN

In rare scenarios, the VPND process may crash during Capsule VPN connections that use Mobile Device Management (MDM) compliance and certificate-based authentication.

PRJ-70108,

PMTR-128831

VPN

Enhanced stability in IKEv2 session establishment.

PRJ-70271,

PRHF-46350

VPN

In some scenarios with DAIP peers, VPN tunnel tests may fail, causing intermittent disruptions.

PRJ-65020,

SDWANGW-2726

SD-WAN

In some scenarios, when the Symmetric Packet Return feature is enabled and kernel debug is running, the sdw_get_isp_id_by_ifnum: kiss_ghtab_bl_get failed ... message is printed repeatedly in the debug output.

PRJ-70118,

CGNSIS-2240

Cloud Firewall

Nightly distribution may fail when no default license pool is set. The system now automatically promotes an available pool during distribution.

PRJ-70061,

PMTR-129147

Cloud Firewall

Reinstalling a Cloud Firewall central license with a regenerated signature may create a duplicate entry in the Management Server's license repository, which could prevent license distribution to managed Security Gateways. The Management Server now detects such conflicts and blocks the installation to avoid creating duplicates.

PRJ-70377,

PMTR-129571

Cloud Firewall

The vsec_lic_cli view command now marks Certificate Keys with expired contracts as (Expired) and provides warnings for Certificate Keys that require renewal.

PRJ-70186,

PMTR-130643

Scalable Platforms

Network Time Protocol (NTP) may stop functioning after an upgrade.

PRJ-70917,

PRJ-70923

Scalable Platforms

After uninstalling an upgrade, the permissions on the $SMODIR/lib directory and related libraries may become more restrictive than required. As a result, the Gaia Portal fails to load pages. Refer to sk185178.

PRJ-61934,

PMTR-108858

Scalable Platforms

In rare scenarios, a full sync may fail to occur after a reboot because the sync is triggered before the full sync request is completely registered.