R81.20 Jumbo Hotfix Take 174

Note:

Download Jumbo Hotfix Accumulator Takes.
This Take contains all fixes from all earlier Takes.

Take 174

Released on 12 November 2026


ID	Product	Description
Take 174 - New Functionality
PRJ-62517 PMTR-116935	Identity Awareness	NEW: The Security Gateway now rotates these log files for the SAML VPN Portal: `$SAML_VPN_PORTAL_HOME/logs/access_log` `SAML_VPN_PORTAL_HOME/logs/error_log`
Take 174 - Improvements and Resolved Issues
PRJ-73741 PMTR-134138	Security Gateway	UPDATE: Resolved CVE-2026-109618 and CVE-2026-109619: PHP vulnerabilities may allow Remote Code Execution through Firewall web interfaces. Refer to sk1000302.
PRJ-73122 PMTR-130045	Gaia OS	UPDATE: Resolved CVE-2026-107484 - Input Validation Vulnerability in Gaia Portal backend handlers allows privilege escalation by an authenticated user. Refer to sk1000291.
PRJ-72793 FMW-11504 PMTR-132772	Gaia OS	UPDATE: Resolved CVE-2026-123039 - Local privilege escalation to root in the DynamicCLI daemon via local world-writable control socket. Refer to sk1000362.
PRJ-59311 PMTR-110791	Scalable Platforms	UPDATE: Resolved CVE-2026-120490 - Administrator with policy and NAT permissions can bypass Sync network protection on Scalable Platforms. Refer to sk1000364.
PRJ-74206 PRJ-74202 ODU-5120 ODU-5113	Automatic Updates	UPDATE: Node.js library version was updated to v22.23.4. Refer to sk1000318.
PRJ-72966 ODU-4791 PRJ-73656 ODU-4924 PRJ-74230 ODU-5057	Automatic Updates	UPDATE: Added Take 180,Take 181, and Take 182 of Web SmartConsole. Refer to sk170314.
PRJ-73043 ODU-4735	Automatic Updates	UPDATE: Added Take 65 of CPquid (QUID) Release Updates. Refer to sk181458.
PRJ-73035 ODU-4889 PRJ-73804 ODU-4980 PRJ-74210	Automatic Updates	UPDATE: Added Take 103, Take 105, and Take 106 of AI Insights. Refer to sk183421.
PRJ-74214 ODU-5099 PRJ-74218 ODU-5092	Automatic Updates	UPDATE: Added Take 143 of Remote API Access Updates and Take 240 of Configuration Sharing Updates. Refer to sk177205.
PRJ-74222 ODU-5078	Automatic Updates	UPDATE: Added Update 29 of Autonomous Threat Prevention Management Integration Release. Refer to sk167109.
PRJ-73791 ODU-4931 PRJ-74234 ODU-5050	Automatic Updates	UPDATE: Added Take 43 and Take 45 of CPM Doctor Release Updates. Refer to sk171505.
PRJ-73040 ODU-4896 PRJ-73787 ODU-4973	Automatic Updates	UPDATE: Added Take 331 and Take 332 of CME (Cloud Management Extension) for Cloud Firewall Release Updates. Refer to sk157492.
PRJ-73031 ODU-4742	Automatic Updates	UPDATE: Added Take 23 of Public Cloud CA for Cloud Firewall. Refer to sk172188.
PRJ-73795 ODU-4903	Automatic Updates	UPDATE: Added Take 97 of HealthCheck Point (HCP) Release Updates. Refer to sk171436.
PRJ-73285 ODU-4833	Automatic Updates	UPDATE: Added Take 40 of CloudGuard Controller Release Updates. Refer to sk181842.
PRJ-73799 ODU-4784	Automatic Updates	UPDATE: Added Update 5 of Server-Side Change Report Generator Release Updates. Refer to sk179508.
PRJ-71751 PRHF-44761	CPView	On Cloud Gateways, the CPU view in CPView incorrectly displays CoreXL SND CPUs as "OTHER" instead of "CoreXL_SND". This issue is cosmetic.
PRJ-73110 PRHF-49329	Security Management	In some scenarios, Management or Log Servers may not appear in the "Connected Managements" view under Management & Smart-1 Cloud in the Check Point Portal. This issue can affect cloud services such as SD-WAN and Configuration Sharing
PRJ-66645 PRHF-44105	Security Management	When a RADIUS role-based user logs in to GuiDBEdit, the system might validate the login against the local database instead of the RADIUS template, causing a local user account to be created.
PRJ-70213 PRHF-45429	Security Management	In a Multi-Domain Security Management environment that manages a large number of Gateways, memory leaks in the FWM process can accumulate over time, resulting in high FWM CPU utilization, out-of-memory conditions, and Management instability.
PRJ-71644 PRHF-47329	Security Management	SmartConsole may unexpectedly crash when importing a malformed PKCS#12 certificate in the HTTPS Inspection configuration.
PRJ-71576 PRHF-47551	Logging	In some scenarios, the process that handles OPSEC LEA log export may unexpectedly crash and generate a core dump file while sending logs to an external application.
PRJ-72006 PRHF-47662	Logging	In rare scenarios, the FWD process may leak file descriptors in the log-forwarding flow and eventually crash after the descriptors are exhausted, which can also cause the Dynamic Objects process to crash.
PRJ-71675 PRHF-47473	Security Gateway	In some scenarios, under sustained file-scanning load, C-ICAP processes consume high CPU and stop responding to new scan requests.
PRJ-72547	Security Gateway	Improved the uninstallation process of the R81.20 Jumbo Hotfix Accumulator.
PRJ-66200 PRHF-43724	Security Gateway	In some scenarios, the CPD daemon may exit with a core dump file.
PRJ-57938 PRHF-48255	Security Gateway	Improved Anti-Spoofing enforcement for point-to-point interfaces that use IPv4 or IPv6 two-address subnets.
PRJ-64064 PRHF-42023	Security Gateway	With the "Same VMAC" feature enabled, the CPView statistics for concurrent connections may become corrupted.
PRJ-65316 PRHF-42747	Security Gateway	In some scenarios, UP_LIMIT drops occur after a failover to a cluster member that has recently rebooted.
PRJ-62947 PRHF-40877	Security Gateway	For traffic processed by Security Servers, destination port NAT is not applied when NAT is configured on the destination port. Refer to sk184158.
PRJ-71066 PRHF-47134	Security Gateway	In rare scenarios, the log partition on a Security Gateway fills up when Packet Capture is enabled in a Threat Prevention policy rule.
PRJ-71139 PRHF-46946	Security Gateway	Re-applying an active Suspicious Activity (SAM) rule may reset its expiration earlier than expected.
PRJ-70427 PRHF-46445	Security Gateway	In some scenarios, the FWK process crashes repeatedly, causing process restarts and potential instability on one or more cluster members.
PRJ-55768 PRHF-34612	Security Gateway	Added performance improvement in HTTPS inspection rulebase.
PRJ-60688 PRHF-36927	Security Gateway	In some scenarios, messages related to send_keepalive and LDAP that do not provide relevant information may appear in the logs.
PRJ-61528 PRHF-39982	Security Gateway	When a service is configured with a source port, the service match may be incorrect.
PRJ-72152 PRHF-45845	Security Gateway	In rare scenarios, access to certain websites may fail with the error: "HTTP parsing error occurred: Connection queue exceeded max size". Refer to sk1000292.
PRJ-71784 PRHF-47591	Security Gateway	After upgrading to R81.20 Jumbo Hotfix Take 158 and higher, with HyperFlow enabled, HTTP responses may fail inspection with a "Response out of state" error, preventing websites from loading. Refer to sk1000007. See Critical Information for R81.20 Jumbo Hotfix Accumulator
PRJ-73645 PMTR-134044	Security Gateway	In some scenarios, very large Network Feeds cause Security Gateway instability or crashes when the feed exceeds the supported limit of 25,000 domains, including Domain objects and their "www." variants.
PRJ-72722 PRHF-48959	Security Gateway	After an upgrade, a Security Gateway with 20 or more CPU cores may experience these issues for tens of minutes or even hours after a reboot, cluster failover, `cpstart`, or policy installation: Very high load average, with a single CPU core at 100%. VPN tunnels, HTTPS Inspection, or Identity Awareness repeatedly disconnecting and recovering. Slow or failed policy installation and, in clusters, unexpected failovers. In CPView, one CPU core is saturated while the other cores are mostly idle. The Security Gateway usually recovers on its own after the traffic load decreases.
PRJ-58770 PRHF-37683	Threat Prevention	In some scenarios, certain websites fail to load because of incorrect handling of the "deflate" response header.
PRJ-70454 PRHF-46251	Identity Awareness	The PDPD process consumes high CPU in legacy (SIC-based) Identity Sharing flows.
PRJ-53965 PRHF-33065	Identity Awareness	The Portal Title configuration in Captive Portal Customization may not take effect.
PRJ-67095 PRHF-43970	Content Awareness	APPX packages delivered without the `.appx` file extension may not be handled correctly by Content Awareness, causing Windows 11 updates to fail.
PRJ-72842 PRHF-48815	Application Control	In some scenarios, SSH and SFTP connections through the Explicit Proxy may be reset immediately after the CONNECT tunnel is established, generating the following log message: "Application Control - Internal system error (4)."
PRJ-73399 PRHF-49769	Application Control	In a rare scenario, the Security Gateway may crash with an FWK process core dump.
PRJ-54058 PRHF-28538	IPS	In certain scenarios, URL Filtering may fail to enforce specific categories when the global IPS mode is enabled.
PRJ-70805 PRHF-46658	DLP	In rare scenarios, a file descriptor (FD) leak can occur in the DLPU process when the flexible hold mechanism is configured for Threat Prevention.
PRJ-66232 PRHF-43729	Anti-Virus	In rare scenarios, the Security Gateway may crash when the Anti-Virus and the IoC feature are enabled at the same time.
PRJ-72263 PRHF-46265	Anti-Virus	Anti-Virus may allow common file types whose hashes are not in the local database without querying ThreatCloud, even when Deep Scan is enabled.
PRJ-71102	Anti-Bot	In a rare scenario, Anti-Bot may crash while performing a reputation lookup for a URL or DNS query.
PRJ-72298 PRHF-47640	SSL Inspection	In some scenarios, the FWK process crashes while parsing wildcard certificates (for example, *.domain.com) in HTTPS connections under heavy load.
PRJ-72195 PRHF-47689	UserCheck	"Report wrong category" option in UserCheck may fail with an unexpected error (HTTP error 400).
PRJ-63126 PRHF-41335	ClusterXL	In a Cluster HA environment, the Gaia Portal on the standby member may present an incorrect server certificate. Instead of the correct certificate, the standby member displays the default self-signed certificate (192.168.1.1).
PRJ-69086 PRHF-45320	ClusterXL	In some VSX deployment scenarios, a Full Sync pnote appears on one of the Virtual Systems because automatic SIC renewal by the ClusterXL daemon does not automatically renew SIC on all cluster members.
PRJ-70295 PRHF-46051	ClusterXL	In some scenarios, NAT64 connections fail on Scalable Platforms.
PRJ-69895 PRHF-46025	ClusterXL	Adding or removing a slave interface from an existing bond after a reboot in VSX ClusterXL can cause a state flap.
PRJ-63760 CLUS-1946	ClusterXL	In some scenarios, Maestro policy negotiation does not show the cluster member ID for the member on which policy enforcement fails.
PRJ-60230 PRHF-38400	ClusterXL	In rare scenarios, a cluster environment may experience a kernel crash or system freeze.
PRJ-69484 PRHF-45813	SecureXL	In some rare scenarios, a policy installation may cause new traffic to be dropped.
PRJ-70617 PRHF-46611	SecureXL	MaaS tunnel communication may fail when traffic is directed to the cluster VIP.
PRJ-70340 PRHF-46353	SecureXL	Improved SD-WAN stability when Forward Error Correction (FEC) is enabled.
PRJ-62619 PRHF-38737	Gaia OS	Check Point Firewall 3600 and 3800 appliances continue to send the SNMP Trap "powerSupplyFailure" even after disabling the alarm LED activation as described in sk166000.
PRJ-72613 PRHF-48564	Gaia OS	In some scenarios, SNMP displays an incorrect VS name.
PRJ-71584 PRHF-47601	Gaia OS	Improved the Gaia Clish `show configuration` command output to eliminate duplicate interface comment entries for bond member interfaces.
PRJ-69902 PRHF-45848	Gaia OS	Enabling the `fw_link_state_propagation_enabled` kernel parameter using the `fw ctl set -f int` command does not persist. The parameter becomes active temporarily but reverts to its previous value after a reboot. Refer to sk185050.
PRJ-72470 PRHF-47439	Gaia OS	Improved the Gaia REST API on Multi-Domain Servers. API requests are no longer rejected with the error "Invalid X-Forwarded-Host header value" when the request includes the server hostname and port.
PRJ-72076 FMW-9899	Gaia OS	After installing the Jumbo Hotfix Accumulator, previous Gaia API task statuses and history are cleared. As a result, users cannot retrieve the status or results of tasks that were executed before the installation.
PRJ-72081 VSX-3373	VSNext	VSX Gateway may stop processing traffic after a sequence of reboots within a Maestro Security Group. Refer to sk1000069.
PRJ-74042 PMTR-134217	Mobile Access	Disabled a deprecated option for Exchange Push notifications in Capsule Workspace, which is no longer supported.
PRJ-72933 PRHF-49166	Mobile Access	In some scenarios, Mobile Access Citrix applications fail to connect to their servers after an upgrade, and the HTTPD process crashes. Refer to sk1000300.
PRJ-71990 PRHF-47903	VPN	StrongSwan client IKEv2 NAT-T connection may fail with "Auth exchange: Sending notification to peer: Invalid syntax" message.
PRJ-63661 PRHF-41115	VPN	Added CA Certificate matching improvements.
PRJ-72241 PRHF-48242	VPN	In some scenarios, simultaneous VPN tunnel monitoring changes prevent RIM routes from being added or removed for some peers in environments with multiple peers and multiple IKED instances.
PRJ-71796 PRHF-47786	VPN	In some scenarios, the IKE process crashes during RIM startup.
PRJ-71663 PRHF-47754	VPN	In rare scenarios, a cluster member may enter a boot loop during an upgrade.
PRJ-69879 PRHF-45871	VPN	High CPU utilization may occur without a corresponding indication of heavy web connection load.
PRJ-73067 PMTR-132950	Cloud Firewall	In some scenarios, accessing Gemini in a web browser results in a blank page when HTTPS Inspection is enabled.
PRJ-70821 PRHF-46381	Scalable Platforms	The `asg vsx_verify` command may falsely report a "Mismatch" for correctly configured VTI interfaces (vpnt*) on VSX Scalable Platforms.
PRJ-72453	Scalable Platforms	In some scenarios, the `asg_diag verify` command fails with a warning about IPv4 routes mismatch: "invalid command name check_func_ipv4_monitor".
PRJ-66653 PRHF-44079	Scalable Platforms	Potentially higher load average / CPU usage on SGMs with fewer than 6 cores after an upgrade from R81.10.
PRJ-72706 PMTR-132629	Scalable Platforms	In some scenarios, creating a new scheduled backup to an SCP server fails.
PRJ-72434 PMTR-132104	Scalable Platforms	The mass_tunnel interface may not come up during an upgrade when management traffic is routed through a data interface, causing policy installation to fail. Refer to sk184660.