R82.10 Jumbo Hotfix Take 36

NEW: Added integration between the Security Management Server and Nozomi to extend Check Point OT capabilities. This integration enables the import of Nozomi Assets and Tags into SmartConsole and their direct use in the Access Control Policy. It improves policy visibility and operational awareness, with enforcement performed on the Security Gateway without requiring an additional policy installation.

• Requires R82.10 SmartConsole Build 426 or higher.

NEW: ServiceNow CMDB integration allows treat ServiceNow as the single source of truth for network objects. Configuration Items and Tags import directly into SmartConsole for use in the Access Control Policy. This removes duplicate object maintenance, improves policy visibility, and enforces on the Security Gateway without an additional policy installation.

• Requires R82.10 SmartConsole Build 426 or higher.

NEW: Permission profiles for Access layers via the Management API are now supported. A new field, "additional-permission-profiles", has been added to the existing "add/set access-layer" Management API.

For example: mgmt_cli set access-layer name "Network" additional-permission-profiles.1 "custom_profile"

NEW: The Virtualization Screen is added to VS0 Insights, displaying Virtual Systems statistics, including Virtual Systems problem detection, alongside general environment metrics and the Resource Search tool.

• Resource Search Tool: Provides a cross Virtual Systems interface search capability.

• Problem Detection: Introduces Virtual System problem indicators in the Status and Problem Categories columns, showing problem classifications. Users can select a Virtual System row in the Virtual Systems table to re-launch Insights in the Virtual System context and investigate issues in AI Detector.

NEW: Added a configuration option for Maestro Orchestrator to forward Spanning Tree Protocol (STP) BPDUs to Maestro Security Group Members. Refer to sk185110.

UPDATE: In environments with thousands of Domain objects or External User Groups, the policy installation duration has been significantly improved.

UPDATE: Resolved CVE-2026-16232 - Authentication bypass with SmartConsole login process using application token. Refer to sk185169.

UPDATE:

• Resolved CVE-2026-25749 - Security scanner flags Vim package on Gaia OS as vulnerable.

• Resolved CVE-2026-28417, CVE-2026-28421, CVE-2026-33412, and CVE-2023-4752.

This Jumbo Hotfix Accumulator Take provides additional Management and Gateway hardening fixes, including VPN Site to Site and Remote Access.

UPDATE: New features and improvements are released in Take 171, Take 173 and Take 176 of Web SmartConsole. Refer to sk170314.

UPDATE: Optimized Mobile Access policy installation to improve performance in environments with a large Mobile Access Rule Base (more than 500 rules).

UPDATE: Resolved the Mobile Access Portal XSS vulnerability in the PHP file.

UPDATE: OpenSSL has been upgraded from version 3.5.5 to version 3.5.7 to address identified CVEs.

UPDATE: Added Take 89 and Take 90 of the AutoUpdater Utility. Refer to sk165653.

UPDATE: Improved warning message, user confirmation prompt, and audit logging when running the "set fcd revert" command in gClish on a Scalable Platform Security Group.

UPDATE: Added Take 94 and Take 96 of Policy Insights Release Updates. Refer to sk183421.

UPDATE: Added Take 57 and Take 59 of CPquid (QUID) Release Updates. Refer to sk181458.

In some scenarios, the "show-tasks" Management API command displays incorrect results when the "from-date" and "to-date" parameters are used. Refer to sk184072.

Packet mode search does not return results for Inline Layer rules in SmartConsole and Management API. Refer to sk184638.

In rare scenarios, some Management API commands may fail with "Management server failed to execute command" error. 

In some scenarios, opening a Security Gateway object in SmartConsole fails with "Smart Dashboard component failed to connect to a server".

Using the "get Interfaces without topology" option on a Security Gateway may remove user-defined interface comments and color settings. Refer to sk180516.

In some scenarios, Multi-Domain Security Management HA synchronization may fail after AI Copilot permissions are updated, until a manual synchronization is performed. Refer to sk185124.

The Security Management Server upgrade may fail during the export phase with the "Object not found - Entities can not be found" message.

When adding a Shared Secret key to a VPN Community object, the operation may fail with the "Update operation failed" error.

SmartWorkflow may incorrectly show zero changes for a session, preventing the change report from being displayed. Refer to sk184779.

In rare scenarios, the FWM process on the Security Management Server may unexpectedly exit, creating a core dump file.

SmartConsole may display a generic error "Failed to save object <object_name>. Server error is: An internal error has occurred. (Code: 0x8003001D, Could not access file for write operation)" when editing interfaces on Spark Firewall.

In some scenarios, on a Spark Firewall cluster, adding a cluster interface to an existing cluster member network fails with the error message "Failed to save object".

API login to the Security Management Server may fail with a "Null Pointer Exception" error when the session name, comment, or description is specified.

A SmartTask configured to send an email after policy installation may fail when the target gateway is a VSX object.

SmartConsole may display the error "the user already exists" when attempting to create a new administrator with the same name as a previously deleted SAML (Identity Provider) administrator.

Policy installation may fail in a Multi-Domain Security Management Server environment when the Global Policy contains a shared inline layer.

In some scenarios, after the FWM process crashes and generates a core dump, High Availability synchronization may fail, and the Security Management Servers may appear as disconnected.

In the VLAN interface, CPView shows the speed of the parent.

A temporary fix related to the QUID identity database (used by CPDiag and AIOps) caused issues in Maestro environments and led to degradation and occasional agent resets in AIOps, as it relies on this component as its IdentityDB. The fix has therefore been removed.

The logs maintenance is running perpetually and is not clearing disk space when the CPPCAP (Check Point Traffic Capture Tool) is enabled.

High load on the LOG_INDEXER process may impact system performance.

In a Management High Availability environment, configuring threshold settings in SmartView Monitor, fails with the "Couldn't load threshold settings for the selected gateway" error.

In a rare scenario, when handling CIFS traffic in the accelerated pipelined path, the PPE and FWK processes may exit. Refer to sk184284.

The memory usage may increase over time when using the Mirror and Decrypt feature.

In rare HTTP/S inspection flows, the Security Gateway may crash if there is a parsing error.

In a rare HTTP/2 traffic scenario, a valid connection may fail.

In a rare scenario, the FWD daemon may restart because of the Application Control Dynamic URL List version file.

Active Streaming Layer connections become stuck, resulting in increased memory consumption over time on the Security Gateway.

In a rare scenario, a memory leak may occur due to a race condition between policy installation and Application Control/IPS signature updates, and persists until the next policy installation.

RSH connections fail when Destination NAT is configured for the RSH server. Refer to sk184768.

In rare scenarios, the FWK process may unexpectedly restart when an HTTP/2 connection containing specific stream characteristics is released.

In some scenarios related to Check Point Active Streaming (CPAS), the Security Gateway may unexpectedly crash.

The ICAP client does not work correctly, impacts the allowed number of characters for the ":service" field in the $FWDIR/conf/icap_client_blade_configuration.C ICAP configuration file.

When ESP traffic is present in the environment, and the fwmultik_dispatcher_in_tap_mode parameter is enabled, the Security Gateway may drop ESP traffic.

Suspicious Activity Monitoring (SAM) rules may not function properly on a standalone device. Refer to sk184330.

HTTPS inspection causes connections to fail when using a custom service with a non-standard HTTPS port (for example, TCP/9400), and the custom service object is configured with "Protocol: None". Refer to sk184294.

In some scenarios, internal memory mishandling in global connections may cause unexpected behavior or connectivity issues.

In some scenarios, Zero Phishing becomes inactive during traffic inspection when Anti-Virus performs a Deep Scan on HTML or JavaScript files.

In rare scenarios, the Anti-Virus fails to inspect HTTP file downloads.

Scaled PDP recovery was improved when specific scaled daemons crashed while Multi-Instance PDP was enabled.

After upgrading an Identity Broker subscriber from R82 or earlier versions to R82.10, broker connections may fail.

The default role in Aruba Networks ClearPass CPPM does not match the identity sessions.

In environments with PDP multi-process enabled, the pdpDispatchd daemon may unexpectedly exit when the Active Directory Query identity source is configured.

A memory leak may occur in the parsers_is TLS module when HTTPS Inspection is enabled and used to inspect non-standard TLS traffic transmitted over a proxy.

In some scenarios, the Custom Threat Prevention policy fails to enforce IPS protection overrides on rules configured with a network group in the "Install On" column.

In a rare scenario, the RAD request may drop when hostname header includes unsupported characters.

The Resource Advisor module continues to perform categorization even when a match is found in the override category.

In a ClusterXL Load Sharing Unicast configuration, the Pivot member intermittently fails to forward packets to the relevant non-Pivot cluster members. This results in packet drops, related to MAC address handling.

In some scenarios, the VSX Security Gateway passes traffic without performing proper NAT from a Virtual Router or Switch's external interface when SecureXL User Mode is enabled.

After rebooting the Security Gateway, the Allow List entry is present when viewing the list, but it is not enforced. The Deny List takes precedence, and traffic from the IP is blocked, even though it should be allowed according to the configuration.

In some scenarios, VLAN tags are stripped and MAC addresses become malformed after traffic passes through the bridge. Refer to sk185101.

On Check Point 3000 Series Appliances, the Multi-Queue Management utility mq_mng displays incorrect interface statistics when run in verbose mode for integrated switch ports.

In a Cloud Firewall environment with Kernel Performance Pack (KPPAK) enabled by default, when modifying the TX queue size parameter for supported network interfaces to 2048 (2K) or 4096 (4K), reverting the setting back to the default value of 1024 (1K) is not possible.

The issue is observed with these synthetic network drivers: virtio (used in GCP and KVM environments), vmxnet3 (used in VMware ESXi), and ena (used in AWS).

Error messages are generated when running the "fwaccel dos statistics get" command, cluttering the usim_x86.elg log file.

On VSNext Clusters, during startup, the ROUTED daemon does not install cluster Virtual IPs (VIPs) on certain non-VS0 Virtual System (VS) routing instances. As a result, Dynamic Routing protocols (such as OSPF, BGP) fail to operate correctly on the affected instances.

The ROUTED daemon may exit when running the "show bgp paths" command.

When the nstat utility (in the iproute2 package) encounters a corrupted state file (for example, if /tmp/.nstat.u0 contains invalid data), it aborts with a core dump instead of providing an error message.

Excessive log entries for RADIUS users logging into Gaia Portal. Refer to sk184534.

Unable to enter Virtual System with "virtual-system-access all" configured. Refer to sk184282.

After an upgrade, in some scenarios, two-factor authentication (2FA) may not be enforced for SSH access. This results in users are able to authenticate via SSH without the required 2FA.

Remote and local backup operations fail after installation of Jumbo Hotfix Accumulator with the "Cannot complete the backup process: not enough space in /var/log/CPbackup/backups" error. Refer to sk183767.

Clish may restart unexpectedly when running the set snapshot-onetime command.

For IDNS-Resolver, when the DNS server returns "TC=1", and communication should be moved to TCP instead of UDP, TCP communication does not block DNS requests.

After restoring the system backup, the restored date and time are displayed incorrectly.

In some scenarios, a Security Gateway crashes because of a memory write overflow in the I/O driver.

Added the ability to import additional .p12 certificate types as inbound and outbound certificates.

Added CA Certificate matching improvements.

When IKEv2 is configured in a Remote Access community, Remote Access clients are incorrectly classified as DAIP (Dynamic Address IP) gateways during IKEv2 negotiation. This causes authentication with machine certificates to fail, preventing successful VPN client connections.

When using Capsule VPN or Endpoint Security VPN (Connect) clients in IPsec mode with IKED enabled, users can successfully authenticate and establish a VPN tunnel. However, group information received from the RADIUS server is not passed to the IKED process. As a result, security policies and access roles that rely on RADIUS group membership do not apply, and users are unable to access internal resources through the VPN.

In some scenarios, the VPN tunnel flaps every 40 seconds when the in-kernel tunnel test is enabled.

Improved address validation in the VPN Remote Access proxy to correctly restrict outbound connections to internal and link-local destinations.

Improved input validation in the VPN L2TP PPP packet parser to handle malformed configuration options correctly.

The VPND or IKED daemon may crash during IKEv2 negotiation.

In ClusterXL environments, a VPN traffic outage of up to 60 seconds may occur after an ungraceful cluster failover.

In a MaaS (Management as a Service) environment, VPN clients (Windows and macOS) enrolling for new certificates may encounter the "failed to enroll new certificate" error.

IKE negotiation fails during Phase 1 when AES-GCM encryption algorithms are used, with third-party devices as the VPN peer. This affects both Site-to-Site and Remote Access VPN scenarios.

In some scenarios, on VSNext environments, Backup and Restore fails to restore a backup, causing all Virtual Systems to be in a DOWN state.

When using VSX SmartProvisioning on Maestro, the operation fails if the VSX Gateway name includes the substring "wrp0".

QoS Policy installation fails when using the DiffServ class in the QoS Policy.

VPN traffic outage may occur in SD-WAN overlay environments.

In some scenarios, SD-WAN ISP link status may fluctuate between UP and DOWN states. Reduced SD-WAN ARP probing default sensitivity to packet drops.

On the Scalable Platform Cluster, LS fragmented packets may be dropped on the receiving member with an error "handle_sim_inbound_frag: error (2): frag freed, ret_val (11): FRAG_ERROR_MSG_DUPLICATE in fragment" on a loaded environment with a lot of corrected fragmented packets.

This may also occur with Cluster HA; however, correcting packets is negligible in such environments.

VPN traffic outage may occur in ClusterXL environments after a Cluster failover.

When a Cloud license's support contract expires, the system now keeps all gateways licensed and alerts the administrator with remediation steps, instead of silently removing their licenses.

The unique IP address assigned to the standby site may not function correctly during a VSNext deployment.

In some scenarios, a 3950 appliance in an ElasticXL cluster fails to bring the Sync interface up because of the link-speed binding.

"TCP packet out of state" or "connection dropped due to state mismatch" messages may be seen in SmartLog or SmartView Tracker. These drops specifically occur on the sync interface, which is used for internal communication and synchronization between Security Group members.

When a Security Group member transitions from a down state to an active state, the synchronization process with other members in the Security Group may not complete before the recovered member becomes active. This can result in traffic drops because of incomplete state synchronization.

The Tunnel Test mechanism may incorrectly select a Sync interface IP address instead of the appropriate external interface IP. This leads to NAT drops and subsequent VPN tunnel disconnections.

A remote user may not be able to switch between Virtual Systems (VSs) in the Gaia Portal. While a local admin user is able to switch between VSs as expected.

License commands such as "g_cplic putlic 192.0.2.15>" fails because of an incorrect calculation of member ID in ElasticXL environment, although the Sync IP address 192.0.2.15 (set up as per sk101556) exists.

In some scenarios, Anti-Spoofing generates excessive drops on ICMPv6 Neighbor Advertisement packets because traffic reaches other cluster members.

In VSLS clusters with multiple members, when a member rejoins the cluster after a reboot, an Interface Active Check (IAC) problem notification may incorrectly appear on the rejoining member, showing it in ACTIVE state. This occurs even though all interfaces are physically UP and the cluster is fully functional.

Upgrade of a Scalable Group in the Traditional VSX / VSNext mode fails.

• The Jumbo Hotfix Accumulator package must be installed on both the Management Server and the Scalable Group.

After joining a VSNext ElasticXL member to a second site via automation, a pnote for the management (magg1) interface appears under vs0 in "cphaprob -a if", instead of under Virtual Switch (vswOID) as expected.

After a Virtual System (VS) is deleted, its CTX folders are not removed.

The "set management interface" command does not show WRP interfaces on Maestro in VSNext mode.

Added the ability for alerts to send traps to trap receiver servers using IPv6.

In Maestro or ElasticXL environments with VPN enabled, traffic may be dropped with the log message "fwha_select_should_drop_vmac".

When performing a SIC reset after Anti-Malware (AMW) has been installed, some members may enter a "cluster-down" state with an AMW Critical Device.