List of All Resolved Issues and New Features in R82.10 Jumbo Hotfix Accumulator

UPDATE: Resolved CVE-2026-18574 - Management Authentication Bypass. Refer to sk185222.

NEW: Introducing Unified Security Management from SmartConsole.

SmartConsole now provides a single management plane for your organization's security - across cloud and on-premises environments. With this release, you can view the AWS firewalls and manage policies associated with your AWS firewalls directly from SmartConsole, with no need to switch between tools or consoles.

Key capabilities:

• Policy visibility - Inspect policies tied to AWS firewalls from one centralized location.

• Cross-account policy sharing - Share and enforce consistent policies across multiple AWS accounts.

• Gateway policy sharing - Extend policy sharing to Check Point Gateways, unifying cloud and on-premises enforcement.

This reduces operational overhead, closes visibility gaps, and ensures consistent security enforcement across your entire environment.

NEW: Added integration between the Security Management Server and Akamai Guardicore to extend Check Point micro-segmentation capabilities. This integration enables importing Akamai Guardicore Assets and Labels into SmartConsole and using them directly in the Access Control Policy. It improves policy visibility and operational awareness, with enforcement performed on the Security Gateway without requiring an additional policy installation.

• Requires R82.10 SmartConsole Build 426 or higher.

NEW: CloudGuard Controller now supports the Claroty Continuous Threat Detection (CTD) Data Center. Refer to the R82.10 CloudGuard Controller Administration Guide.

NEW: Central License Utility now sends events to Events & AIOps upon license distribution failures and recoveries. Events are reported for both full distribution runs and single distribution, enabling proactive monitoring and alerting through AIOps. Refer to the Cloud Firewall Central License Tool Administration Guide.

NEW: Added support for integrating clean-install machines running a higher version into an existing ElasticXL environment.

UPDATE: Resolved CVE-2026-62144 - Management Authentication Bypass and Privilege Escalation. Refer to sk185152.

UPDATE: Check Point Response to CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag) and CVE-2026-46300 (Fragnesia). Refer to sk184928.

UPDATE: Resolved CVE-2026-62145 - Local privilege escalation in Gaia Portal. Refer to sk185153.

UPDATE: In the Logs view, search performance is improved when the search term includes a Cluster.

UPDATE: Added Take 65 and Take 70 of Log Exporter Auto Update Deployment. Refer to sk182866.

UPDATE: The Security Gateway now complies with RFC-4291 by blocking the forwarding of IPv6 packets that contain link-local addresses (FE80::/10) in the source or destination fields.

UPDATE: Added validation for bridge ID during the bridge creation on VSNext in Gaia Portal.

UPDATE: Gaia API updates are now included in the Jumbo Hotfix Accumulator (previously were installed by AutoUpdater). See sk143612.

UPDATE: Old SVMAC feature is now deprecated ("toggle_same_vmac" parameter is blocked). Only use the new SVMAC feature ("toggle_same_vmac_os"). Refer to sk165674.

UPDATE: Improved Debug Filtering for specific flows in SecureXL User Space Mode (UPPAK) debug messages.

UPDATE: Added Take 93 and Take 94 of HealthCheck Point (HCP) Release. Refer to sk171436.

The FWM process may exit because of memory exhaustion and generate large core files (up to 4GB).

The "show-global-properties" Management API command fails when there is a database inconsistency in the "keep-hit-count-data-up-to" field.

The Management API v2 command "show-vpn-communities-star" with details-level full may fail with an "Internal error" message when a Virtual System Cluster member is configured as a satellite in a VPN Star community.

In some scenarios, running the "api stats" command with the "-calc_avg_duration" flag on the Security Management Server fails with the "IndexError: list index out of range" error. Refer to sk184144.

In some scenarios, the submit-time field in emails generated by SmartTask displays an incorrect value.

Cross-domain sharing might be incorrectly configured on the PDP Security Gateway when Identity Broker is the sole enabled identity source.

Policy installation may fail with "failed to get tls rulebases from policy id".

In some scenarios, the FWM process on the Security Management Server may unexpectedly exit when performing the "Fetch branches" action in the LDAP Account Unit properties window of SmartConsole.

Configuration sharing from a Management Server to the Check Point Portal may fail with a "Did not get reply from Docker" error.

In rare scenarios, the Security Management Server fails to start after performing the "Revert to Revision" operation.

Policy installation may fail when an inline layer is used more than once in the same policy and this error is displayed "Policy installation had failed due to an internal error. If the problem persists please contact Check Point support".

In some scenarios, accumulated open sessions can cause the Security Management Server to become unavailable.

In some scenarios, fwmtrace.log* files consume a significant amount of disk space.

Opening objects in SmartConsole may fail with the error "SmartDashboard component failed to connect to server".

In some scenarios, an API key may become invalid after editing an administrator account.

SmartTasks may fail to send email notifications with a "send mail to <email address> failed" error when the Cc field is populated.

In rare scenarios, the FWM process on the Multi-Domain Security Management Server may not stop after running mdsstop.

In some scenarios, task notifications are not triggered for the Automatic Revisions Purge process, and the task status is not displayed correctly in SmartConsole.

CPU information may not be displayed in the CPU tab in CPView for an environment with Virtual Systems.

Internal CA now automatically recovers from transient database lock errors without requiring a process restart.

In some scenarios, the LOG_INDEXER process unexpectedly exits and generates a core dump.

SmartEvent processes may unexpectedly exit in environments containing over 1 million network objects.

In some scenarios, the SmartLog Server process may unexpectedly exit and generate a core dump.

There may be high CPU usage by the CMID process when the ICAP Client is enabled on Security Gateway. Refer to sk184524.

In a rare scenario, the FWK process crashes when the Mirror and Decrypt feature handles large MTU frames.

On ClusterXL and in Maestro Security Groups, after performing a rolling upgrade that includes a change in the CoreXL instance count, newly created firewall instances may remain in local-sync-only mode. As a result, these instances do not receive state updates from their peers, leading to intermittent connection failures and "First packet isn't SYN" drops. Refer to sk184786.

After an upgrade, the "show configuration" command output for MDPS may be missing bond configuration.

Jumbo Hotfix Accumulator installation on Security Gateways with MDPS enabled may fail with a verification error "Installation is not allowed". Refer to sk184950.

The RAD daemon may unexpectedly exit when customizing RAD internal parameters ("max_flows" and "queu_max_capacity"). Refer to sk182136.

FTP transfers of files smaller than 1KB fail and result in empty files on the destination server. Refer to sk184200.

FTP traffic does not pass through Security Gateway when using the FTP Extended Passive Mode. Refer to sk183853.

There may be log entries related to the drop optimization feature, although the dropped traffic matches a non-logging rule.

When ISP Redundancy is enabled, and the administrator changes the priority, the primary ISP may not be updated in the Security Gateway (the route is updated, but the Security Gateway continues to consider the old ISP as the primary/standby). Refer to sk184923.

Some service ports may be missing in some instances, resulting in unexpected behavior for some services.

In a rare scenario, the FWD process may crash during Policy Installation because of memory corruption related to licensing.

In some scenarios, SmartConsole RSA SecurID administrator login fails, and the FWM process unexpectedly exits. Refer to sk184844.

In some scenarios, enforcement of an Indicator of Compromise (IoC) feed containing mail observables may fail if the feed file includes a single malformed entry because of a parsing error.

SSH connections may fail after enabling SSH Deep Packet Inspection (DPI).

IoC feed observables may continue to be enforced even after Anti-Virus and Anti-Bot are disabled.

The Microsoft Graph API access token does not renew if an authorization error occurs while working in on-demand fetch mode.

In some scenarios, the PDPD process stops responding and users cannot authenticate through the Identity Awareness. Refer to sk184407.

SNMP queries to the Security Gateway may return unexpected results: specific IP addresses or Identity Collector objects may continue to appear in SNMP outputs even after being removed from the topology configuration. Additionally, polling OIDs such as 1.3.6.1.4.1.2620.1.38.55 or 1.3.6.1.4.1.2620.1.38.53 may result in the message "No Such Instance currently exists at this OID".

TLS Inspection and HSM statistics are not available through SNMP requests.

When HTTPS Inspection is enabled, the Security Gateway uses the global (default) outbound CA certificate, even though an outbound CA override is configured in SmartConsole. Refer to sk184880.

When using custom applications and SD-WAN, HTTPS traffic may be blocked with "Reason: Application Control - Internal system error" in SmartConsole log.

An HTTPS Inspection rule that contains a custom application whose name includes spaces or certain unsupported characters does not match during policy enforcement. Refer to sk184773.

In rare scenarios, the RAD process may exit generating a core dump.

When processing VPN traffic in a ClusterXL environment with "sync-to-all" enabled, the absence of sequence number updates from the active site can cause the Fast Acceleration (FnA) mechanism to become unresponsive. As a result, affected connections may be dropped, and such log entry is generated "dropped by fw_conn_inspect Reason: Frozen connection".

When both Quality of Service (QoS) and VPN features are enabled, memory corruption may occur in the mbuf. This can lead to an exit of the USIM process during the handling of QoS flows.

In some scenarios, VPN packets are dropped in User Mode (UPPAK) during encryption when QoS is active.

PPTP/GRE traffic fails when Hide NAT is used and SecureXL runs in UPPAK mode and the "fw_pptp_enforce_protocol" parameter is enabled. Refer to sk184641.

The USIM process may exit with a core dump during modular configuration.

The "arping" command on the Security Gateway returns this output "Sent 4 probes Received 0 response" in SecureXL User Mode (UPPAK). Refer to sk184292.

A reference count issue in the UPPAK module can cause a USIM core dump, particularly on busy systems with long uptime.

In the VSX environment, the BGP Routed Critical Device (PNOTE) never clears after rebooting both cluster members simultaneously or during an upgrade.

The ROUTED daemon may exit with a pnote on Security Group Members after the Orchestrator daemon (ORCHD) stops. Refer to sk184771.

In some scenarios, SNMP monitoring may incorrectly report 100% CPU usage. 

In rare scenarios, the CORE_UPLOADER process on Security Gateways may unexpectedly generate a core dump when the number of detected CPU cores exceeds a specific threshold.

In a rare scenario, after several reboots, the Security Gateway restarts with an empty

/etc/udev/rules.d/ rules file. As a result, the interface renaming configuration is lost, and network interfaces revert to default names, potentially disrupting network connectivity and management.

In some scenarios, VPN throughput slowness occurs on Check Point Firewall 3900 Appliances.

In Gaia Portal, for VSNext, the Bridge Group field displays the validation error "The minimum value for this field is 1001," but does not enforce it, and it is possible to submit and create bridge object IDs with values below the minimum threshold. The fix adds validation for the bridge ID during bridge creation in VSNext.

After disabling Two-factor authentication (2FA) in Gaia OS, the user still requires a 2FA code on login attempts.

In Gaia Portal, bond member interfaces can be edited when they should be disabled.

The Bash Shell Logging procedure is now working in R82.10 and higher versions. Refer to sk99134.

After hardening non-RFC-compliant HTTP requests, some Mobile VPN connections fail. Since multiple clients send bare LF requests (a specific type of non-RFC-compliant traffic), bare LF errors are now disabled by default. This behavior can be enabled using the kernel parameter "ws_block_bare_lf".

Automatic Security Gateway certificate enrollment using CMP with an external OPSEC PKI CA (for example, EJBCA) fails with "Internal Error" status in SmartConsole.

Improved certificate validation during IKEv2 VPN negotiations to ensure VPN connections are established only after successful certificate-based authentication.

Remote Access IKEv2 VPN authorization may fail for LDAP Active Directory users whose Common Name (CN) in their certificate is email-based (for example, user@domain.com). When such users authenticate using an External User Certificate, they are unable to pass traffic to the Encryption Domain, resulting in dropped connections.

In ElasticXL environments, a stale NAT-T port in the cluster sync overwrites the correct port.

Traffic passing through a route-based VPN tunnel may cause high CPU usage if the traffic is fragmented.

In VPN Site-to-Site environments, a memory leak in VPN-related processes may occur after a VPN driver restart, or during prolonged system runtime.

CRL files may not be synchronized as expected in Management High Availability and Multi-Domain Security Management environments.

VPN traffic outage may occur in ClusterXL environments with IKEv2 after a Cluster failover.

VPN traffic outage may occur in ClusterXL environments with SD-WAN Overlay or Enhanced Link Selection after a Cluster failover. The new Active cluster member fails to properly handle VPN traffic because of synchronization or MAC address handling problems.

When Hub Mode is not enabled, traffic destined for dynamic objects included in the Remote Access VPN Split Tunneling Inclusion group may be incorrectly dropped. As a result, remote users may be unable to access resources defined by these dynamic objects, even though they are specified for inclusion in the split tunnel.

In some scenarios, on Maestro VSNext setups, a bridge is shown in a down state in the WebUI interfaces table immediately after creation in the Virtual System (VS) context.

After deleting several Virtual Systems, stale wrpj interfaces remain attached to Virtual Switches. SmartConsole shows these orphaned interfaces with error text "Virtual System with the ID X does not exist".

Added new SNMP OIDs to enable monitoring of physical resources per Virtual System (VS) via VS0.

In a rare scenario, the FWK process may crash when handing SD-WAN traffic.

SD-WAN overlay traffic debugging is improved, enhancing visibility and troubleshooting capabilities.

In some scenarios, enabling SD-WAN Symmetric Return may lead to elevated CPU utilization on Secure Network Distributor (SND) cores.

VPN traffic outage may occur in ClusterXL environments after a Cluster failover.

Deleting a license pool while Cloud Firewall Gateways are still associated with it causes all licensing operations (add, distribute, remove) to continuously fail until the orphaned reference is manually cleared from the database.
The fix allows licensing operations to complete normally without administrator intervention.

Moving Cloud licenses from one pool to another triggers license alignment: If adding a new license to CK fails, license removal will not be initiated on the Security Gateways.

When deleting a bond in an ElasticXL environment, site failover may occur.

• When a large number of bond interfaces are configured, the synchronization of link states may fail.

• In rare scenarios, a cluster member may become stuck in the "active (sync)" state. When this occurs, the affected member does not handle network traffic as expected.

• There may be inconsistencies in the reported link state across Security Group Members (SGMs), as observed with the "asg stat -v" command.

Deleting a bond may trigger a site failover because LACP negotiation resets the IPs of slave interfaces, leading to an IAC pnote and failover.

Virtual Systems are sometimes stuck with a during_boot pnote if multiple Virtual Systems are created simultaneously. As a result, Secure Internal Communication (SIC) with the Security Management Server is not established.

On Maestro appliances, /var/log/messages may be flooded with "asg_copy_capture" error messages when the system attempts to retrieve packet capture files that do not exist on remote Security Group members.

The PERFANALYZE process may exit because of an incorrect value type. As a result, SNMP performance data for the Security Group (ASG) is not updated.

When adding or removing VS, if the freeze timeout ended before the VS was fully stable, the VS might still have a Critical Device (pnote), which will cause the member to go down. Refer to sk185115.

Intermittent VS failover when both Maestro Hyperscale Orchestrators (MHOs) have the interface link state set to Down. Refer to sk184568.

In a dual-site Security Group configuration, if all members of site 1 are removed from the Security Group, the Hardware tab in SmartConsole displays an error message instead of the expected hardware information.

Added monitoring to detect connectivity failures between Dual-Site MHOs when the site-sync path is not directly connected. Refer to sk184381.

In some scenarios, a Gateway that leaves the cluster is still shown as an active member to other Security Group members. This can result in the Gateway not being displayed as an available Gateway.

In Single Site mode, Security Groups containing more than 14 members may experience connectivity issues.

The "CliError( ) called without module or error code" error message is displayed when attempting to run VSX commands on an unsupported configuration in Clish.

All traps coming from a dedicated Member of a Security Group now include the hostname.

For example, a trap for Member 1_4 will include the hostname (for example, hostname-s01-04), providing clearer identification than just 1_4.

Policy installation on one Virtual System (VS) fails without a visible error message. Refer to sk184194.

A GTPv0 tunnel fails to establish under certain conditions.

UPDATE:

• Resolved CVE-2026-50751 - User Authentication bypass on VPN Remote Access and Mobile Access in deprecated IKEv1 key exchange. Refer to sk185033.

• Resolved CVE-2026-50752 VPN site-to-site certificate bypass vulnerability in deprecated IKEv1 key exchange. Refer to sk185035.

NEW: Policy Auditor is a policy analytics and auditing tool that provides visibility into traffic behavior within the user's network. In SmartConsole > Security Policies > Access Control, Policy Auditor presents a matrix view of the network's logical segments and the access rules defined between them. The tool allows administrators to audit these security rules and verify that they align with organizational access policies and segmentation requirements.

• Requires R82.10 SmartConsole Build 424 or higher.

NEW: Added a new Management API command to retrieve an entire Access Control Layer (including inline layers) - "export-access-rulebase".

UPDATE: Resolved CVE-2026-48132 - VPN process may restart unexpectedly when processing IKE traffic over NAT-T 4500/UDP. Refer to sk184982.

UPDATE: Resolved CVE-2026-48134 - SQL injection issue in UserCheck Web Portal when DLP is active. Refer to sk184983.

UPDATE: Resolved CVE-2026-48136 - Authenticated Administrator Role-Based Access Control Bypass in Compliance. Refer to sk184992.

UPDATE: Upgraded OpenSSL from version 3.5.4 to version 3.5.5 to fix CVE-2025-66199.

UPDATE: The HSM password is now configured in the secrets_manager tool using the "secrets_manager setpassword hsm" command. This provides centralized management and improved handling after configuration.

UPDATE: Policy installation is now accelerated after performing Global Domain Reassignment.

UPDATE: Added a new HCP test that analyzes load balancing and NAT utilization, and suggests optimal distribution adjustments accordingly. Refer to sk171436.

UPDATE: Added the ability to automatically stop kernel debugging after a specified number of seconds. See the R82 Quantum Security Gateway Administration Guide. Refer to the command "fw ctl debug -T <Number of Seconds>".

UPDATE: Added infrastructure support for the Microsoft Azure Network Adapter (MANA) driver.
Note: The MANA driver is functional, but it is not yet recommended for general use. Refer to sk183754.

UPDATE: Added Take 43 of Check Point Support Data Collector (CPSDC) for Scalable Platforms and Maestro Security Appliances. Refer to sk164414.

UPDATE: Added Update 27 of HealthCheck Point (HCP) Release. Refer to sk171436.

UPDATE: Added Update 28 of Autonomous Threat Prevention Management Integration Release. Refer to sk167109.

Reinstallation of R82.10 Jumbo Hotfix Accumulator Take 6 may result in configuration loss.

See the Critical Information section.

The "set-checkpoint-host" Management API command with the "interfaces" field may fail with the "generic_err_invalid_parameter" error.

In some scenarios, SmartConsole disconnects during policy installation.

If the MGMTCOMP-DIFF-REPORT-CLIENT process becomes suspended on the Security Management Server, the Server-side Change Report Generator fails to generate and send reports when processing a large number of changes.

Upon creation of a new Domain on a Multi-Domain Security Management Server, the Domain Server's virtual IP address is not added to the Gaia database, making it inaccessible via Clish commands. Refer to sk183941.

The delay may be observed during the "compiling policy" and "generating policy files" stages in SmartConsole.

In some scenarios, CPVIEW_API_SERVICE may unexpectedly restart and generate a core dump file.

The CPVIEWD daemon may exit during startup.

CPView may display "N/A" values for logging-related metrics when there is insufficient free disk space in the log partition.

In some scenarios, non-ASCII characters may appear garbled in SmartEvent Automatic Reaction emails.

In SmartView Monitor, opened from Logs & Events > Tunnel & User Monitoring, the "SmartEvent Correlation Unit" status may be displayed as "Not running" although the CPSEMD process is running.

Test feed fails when testing a Network Feed object with the feed parsing format configured as JSON. Refer to sk183618.

Running the "g_tcpdump mcap" with "-C" flag fails with the file matching or captured packets merging error.

In rare scenarios, the FWK process may exit when parsing an invalid SIP packet.

The SD-WAN NAT rule may not be applied when no NAT is defined in the Access Control policy.

In rare scenarios, after an upgrade, the Security Gateway may crash because of a missing route.

Legitimate files may be incorrectly flagged as malicious when scanned with ICAP. Refer to sk184628.

In some scenarios, when processing HTTPS traffic in the accelerated pipelined path, the FWK process may unexpectedly exit.

The Security Gateway may fail to correctly handle return traffic for pass-through GRE connections in scenarios with NAT.

In Smart-1 Cloud environments, the "Threat Prevention" view may display 0 in the "Logs" column under the "Top Protections" widget. Refer to sk184505.

The TLS-based Identity Sharing connection between the Policy Decision Point (PDP) and Policy Enforcement Point (PEP) may fail to establish when using IPv6 transport.

Identity Awareness AD user authentication takes a long time. Refer to sk183748.

In a rare scenario, when using Dynamic URL List, updating the version file may result in a FWK process restart.

In some scenarios, the Security Gateway may drop DNS traffic with non-malicious Domains.

When Mobile Access is working in Path Translation (PT) Link Translation mode, the Citrix application may not load after an upgrade to Citrix version LTSR 2507.

After rebooting specific Security Group Members (SGMs) in a dual-site Maestro environment, PDP (Policy Decision Point) to PEP (Policy Enforcement Point) connections are not always corrected to the SMO (Single Management Object) as expected. This results in connection restarts and additional CPU load.

When MDPS is enabled, cluster members may remain in INIT or DOWN state after reboot.

IPv4 addresses in the SYN Defender Allow List in SmartConsole may be loaded with the address octets reversed.

When loading the SYN Defender Allow List from the Gateway CLI using only the "-L" parameter, the entries are merged with the existing Allow List (including those configured in SmartConsole), rather than overwriting it.

The USIM process may exit on Check Point Firewall 3900 appliances during IPsec VPN traffic decryption.

In some scenarios in a VSX Maestro Security Group, when SecureXL User Mode (UPPAK) is enabled, a cluster member may incorrectly forward traffic through a Warp interface to the incorrect Virtual System. This results in traffic not being processed by the intended Virtual System, potentially causing "Out of State" drops.

When using Virtio or net_iavf drivers, when configuring "mq_mng" and setting the core count to match the SND (Send) core count, a portion of network traffic may be lost.

In some scenarios, when installing a policy fails, the Sand Blast Security Gateway becomes unresponsive and reboots automatically. The "Installation failed. Reason: Due to a timeout value of 600000 (millisecond) (port) (IP), Security Management Server aborted the connection with the peer" error is displayed in SmartConsole.

The Security Gateway with SecureXL User Mode (UPPAK) enabled may not properly update routes when bond interfaces are configured.

A ROUTED daemon may exit with a dump file during an OSPF route lookup on a route being redistributed between BGP and OSPF.

Custom log rotation configured using Gaia OS does not apply to SAML-related log files, so these logs are not rotated automatically. Refer to sk113241.

Cloning groups may fail during configuration updates. Refer to sk184701.

Newly added SGM remains "Down" on Scalable Chassis with SSM440 configured with MTU higher than 9000. Refer to sk184653.

CPU spikes may occur in a cluster when SNMP is enabled.

Multiple Entry Point (MEP) validation may be incorrectly triggered when switching a Star Community to a Route-Based community.

SSL Network Extender Portal is accessible even when it is disabled in SmartConsole. Refer to sk184344.

When switching a VPN community from Route-Based to Domain-Based mode, the Tunnel Sharing setting may not reset to its default value. After the switch, Tunnel Sharing remains set to Per Gateway Pair instead of reverting to the Domain-Based default of Per Subnet Pair. No notification is displayed to alert about the discrepancy, which may impact performance.

In some scenarios, over time, prolonged VPN traffic may lead to gradual memory growth.

VPN traffic from L2TP clients may fail to pass through the Security Gateway working in SecureXL User Mode (UPPAK).

Remote Access Endpoint Security Client may fail to connect.

When a Virtual System (VS) is deleted from a VSX Security Gateway, the Dynamic Split feature does not properly recognize the removal and continues to attempt fetching data or updating CPU affinity for the deleted VS. This results in repeated errors or log entries referencing the non-existent Virtual System, and may interfere with CPU core allocation and affinity management for the remaining VSs.

The "show configuration" gClish command may fail for showing configuration for LLDP, VSNext, VSLS, SSH, and OSPF.

Incorrect MAC address configuration on WRP interfaces in a VSNext environment leads to ClusterXL Load Sharing malfunctions and traffic correction issues.

In VSNext ElasticXL and VSNext Maestro, running the "cpconfig" command from Clish/gClish within a Virtual System context may trigger execution in the Global context.

The FWM may unexpectedly exit when attaching a license to a Security Gateway using vSEC license distribution (vsec_lic_cli).

Registration of Data Center assets with a numeric, non-UID unique identifier may fail, potentially causing performance impact on the Security Management Server.

A VPN IPv6 traffic outage may occur when a host/network object is defined with the Security Gateway's main IPv6 address.

Security Gateway may drop legitimate H323 traffic with "Illegal H.225(Q931) No Q.931 User-user IE found". Refer to sk184591.

In a Maestro environment with Multi-Domain Security Management and enabled MDPS, SNMP per member queries do not survive member failover. Additionally, SNMP queries to the SMO may be routed to the dplane instead of the mplane.

In a Maestro environment, deleting a configured VXLAN from the Security Gateway using gClish on VS0 results in a "Segmentation fault (core dumped)" error, despite successful deletion from SmartConsole.

If a management interface on ElasticXL Security Gateway is a part of a bond, the license distribution mechanism may not work as expected.

Rebooting an Active member in the Single Management Object (SMO) role may trigger a brief connectivity loss.

After an upgrade to R82.10 of the Maestro environment, connecting using SSL Network Extender (SNX) fails. The Security Gateway drops the packets with the reason "clear text packet should be encrypted".

In VSX setup, a configuration note may be generated after a reboot, although the configuration is synchronized.

Members added to an ElasticXL Security Group with the MDPS feature enabled may remain in the Down state because of a missing license. Licenses are not automatically distributed from the SMO member to newly added Security Group members.

On Maestro running VSNext, when a Virtual Switch (VSW) shares a physical interface with a Virtual System (using different VLANs), the VSW's VLAN interface may not be propagated to the Maestro Hyperscale Orchestrator (MHO). Refer to sk1000003.

The FWK process may exit when GTP Intra Tunnel Inspection is enabled.

NEW: Added new OID (1.3.6.1.4.1.2620.1.38.55) to monitor the Identity Collector connection status in the $CPDIR/lib/snmp/chkpnt.mib file.

• This capability is supported for Identity Collector agents running with version R82.120.0000 or higher.

NEW: It is now possible to add host/network/range objects for split tunnel on exclusion/inclusion modes. Refer to R82.10 Remote Access VPN Administration Guide.

UPDATE: When connecting a Domain to the Check Point Portal, Dedicated Log Servers in the Domain are now connected automatically.

UPDATE: New features and improvements are released in Take 155, Take 156, Take 157, Take 163, Take 164 via self-updatable package. Refer to sk170314.

UPDATE: Added Take 27 of Autonomous Threat Prevention Management integration Release. Refer to sk167109.

UPDATE: Added Update 26 of HealthCheck Point (HCP) Release. Refer to sk171436.

UPDATE: Added Take 53, Take 60 to Log Exporter Auto Update Deployment. Refer to sk182866.

UPDATE: Added Take 88 of CPViewExporter Release Updates. Refer to sk180521.

When using the "add/set data-type-weighted-keywords" and "add/set data-type-file-attributes" Management API commands, the field "description" is missing from the response.

The "show-packages" Management API command executed with "async-response" parameter may fail with "generic_err_invalid_parameter_name".

In some scenarios, scheduled Compliance scans are not executed after setting the intervals via the "set compliance-settings" Management API command.

In the "HTTPS Inspection Statistics" in SmartView, filtering by the "bypass_reason" field returns no results.

When using a Security Gateway as a Proxy "Non-transparent" and HTTPS Inspection is set to "inspect" with "X-Forward-For header", video playback on YouTube fails.

The FWK core dumps may be generated when the Security Gateway is processing HTTP traffic.

When configuring NAT64 rules for specific targets, the rules may fail to apply. Return traffic may be dropped.

In a rare scenario, the Threat Prevention Rule Base may fail to match traffic to any rule.

In a rare scenario, a Policy Decision Point (PDP) Security Gateway that acts as both an Identity Broker Subscriber and a sharing identity with a Policy Enforcement Point (PEP) may become unresponsive.

In a rare scenario, there may be no access to resources for identities received from the Remote Access identity source.

In some traffic flows, packets containing certain headers may be dropped regardless of how the non-compliant HTTP Inspection is configured.

Mobile Access Software Blade may incorrectly terminate Guacamole-based clientless RDP/SSH sessions due to client idleness.

After an upgrade, the Mobile Access Software Blade's CVPND process fails to load and the Mobile Access Portal becomes inaccessible when adding new Virtual Systems (VSs) or converting to a VSX Gateway, due to improper updates to the gateway-side configuration file cvpnd.C. Refer to sk183293.

In an asymmetric UDP traffic scenario (Client-to-Site VPN and Site-to-Site VPN distributed to different members), the connection may not get accelerated.

When SecureXL works in User Mode (UPPAK) on Security Gateways with CPAC-4-10F-C interface modules, invalid Ethernet frames permanently shut down the port's transmit queue, causing complete connectivity loss.

Upon logging in to the Gaia Portal, the login page accepts the credentials, briefly displays the homepage, and then automatically redirects back to the login screen.

Users cannot create read-only roles, cannot modify roles by removing permissions, or assign roles with all features to specific virtual servers, and all operations fail silently without warnings.

Starting March 1st, 2026, newly created certificates and newly generated CRL may fail validation. Refer to sk184766.

When attempting to create a new Virtual System (VS) with management connectivity enabled, the operation may fail. This prevents the successful provisioning of the Virtual System in the environment.

After adding a virtual link between a Virtual System (VS) and a Virtual Switch (VSW), policy installation may fail with the "Installation failed. Reason: TCP connectivity failure [ error no. 10 ]" error.

The Cloud Firewall Central License utility fails to distribute a single license using CLI.

Maestro Orchestrator fails to add a new Security Appliance to a Security Group when the Maestro Fastforward feature is enabled in the Security Group. Refer to sk184233.

After an upgrade in the Maestro and Chassis environment with multiple Virtual Systems (VSs), the disk may reach full capacity.

After creating a bridge interface using Gaia Portal and rebooting, the Security Gateway state is down.

Link-local per-member address calculation between ElasticXL members may not be correct.