R82.10 Jumbo Hotfix Take 44

NEW: The Virtualization Screen is added to VS0 Insights, displaying Virtual Systems statistics, including Virtual Systems problem detection, alongside general environment metrics and the Resource Search tool.

• Resource Search Tool: Provides a cross Virtual Systems interface search capability.

• Problem Detection: Introduces Virtual System problem indicators in the Status and Problem Categories columns, showing problem classifications. Users can select a Virtual System row in the Virtual Systems table to re-launch Insights in the Virtual System context and investigate issues in AI Detector.

UPDATE: After running the Get Interfaces command, updating VTI interface objects can fail on Spark Firewall clusters if VPN peer names were changed.

UPDATE: The HCP configuration sync verifier (the config_verify command) may incorrectly indicate a mismatch in the fwkern.conf file due to differences in the line order between members.

UPDATE: Added Take 10 of CloudGuard Controller Release Updates. Refer to sk181842.

UPDATE: In environments with thousands of Domain objects or External User Groups, the policy installation duration has been significantly improved.

UPDATE: Added support for treating trusted CA certificates with non-compliant attributes as valid. This includes certificates with incorrect Key Usage settings or missing Basic Constraints, based on customer-defined configurations. Refer to sk183800.

UPDATE: Resolved CVE-2026-85103 - ASN.1 decoding heap overflow leading to a remote code execution. Refer to sk1000118.

In a Management High Availability environment, the statuses of clusters and cluster members may be displayed incorrectly on the secondary Security Management Server.

In rare scenarios, login to SmartConsole may fail due to a timeout.

Policy installation may fail with error code 0-2-2000078 when a policy rule references a track object that cannot be resolved.

In some scenarios, when a Multi-Domain Security Management Server is connected to the Check Point Portal, a connectivity failure warning for the Global SmartEvent server may appear, even though Global SmartEvent servers are not supported in the Check Point Portal.

On a Multi-Domain Security Management Server, the "api stats-group-by-domain" command may report all requests as "unknown domain" instead of categorizing them per domain. Refer to sk183892.

When generating a Show Changes PDF report for a workflow or session, the report could include internal system changes, such as IPS protection changes, that were not performed by the user.

SmartConsole may display a "No communication" error message caused by a file descriptor leak in the FWMHA process after prolonged uptime.

In unpublished sessions, the Change report may not display the names of newly created objects when these objects are added as members of another object.

After deleting a Security Management Server object, attempting to create a new management host object with the same IP address may fail with an "IPv4 address is already in use" validation error.

Improved debug logging in the cpm.elg file during upgrades of a Multi-Domain Security Management Server.

When one administrator installs a policy, other logged-in administrators may see an "Error retrieving results" message in the Tasks window instead of the policy installation progress.

Administrators logging into SmartConsole with certificate authentication at the MDS level using the "\MDS" format may unexpectedly receive read-only permissions instead of the expected read-write access.

In rare scenarios, the accumulation of large API request-status files could cause Security Management Server slowness.

Security Gateways created using the Management API or SmartConsole might be assigned duplicate Dynamically Assigned IP (DAIP) addresses. Refer to sk185077.

When a Data Center object is imported into SmartConsole and the session is discarded, the object may not be removed and might remain visible in SmartConsole.

In some scenarios within Multi-Domain Security Management environments, AI Assist may display the following error message: "There was an internal error processing the query".

When running the LSMcli AddROBO command with the -S (SubstitutedNamePart) parameter, the cluster profile name suffix may not be substituted correctly.

When viewing Forensics Reports in SmartView through the Check Point Portal, non-ASCII characters may appear distorted.

Exporting logs that contain "&" in their fields to a CSV file via SmartView web application may fail with a “Failed to export” error message.

In some scenarios, the LOG_INDEXER process may crash repeatedly, causing core dumps on the Security Management server.

When viewing logs in the Check Point Portal, a "Query failed" error message may intermittently appear for several minutes.

In some scenarios, the LOG_INDEXER process may unexpectedly exit and generate a core dump while processing log files.

In some scenarios, incorrect memory size allocation identified in the c_icap open-source code may cause a crash in the ICAP Server.

In a rare scenario, the Security Gateway may crash during email inspection.

The RAD daemon may unexpectedly exit on VSX Gateways.

In some scenarios, CPView may display an incorrect value for CPU user time. Refer to sk184722

Optimized DNS handling to align with the DNS additional configuration formats.

In some cases, an ICAP server closing the connection to an ICAP client with an RST may cause an FWK process crash.

Some valid HTTP requests may be incorrectly identified as malformed and blocked.

An issue in the parsing function may cause the FWK process to crash when handling an MCP connection.

In a Smart-1 Cloud cluster environment, users may not see the cluster member status in Netscout if ICMP traffic is blocked.

In rare scenarios, a Security Gateway may crash when LSP (Link State Propagation) is enabled.

When using ISP Redundancy in a VSNext environment, failover between ISPs may not occur if the WRP interface is configured as one of the ISPs.

In some cases, the Captive Portal fails to authenticate users when SAML authentication is enabled.

In some scenarios, Spike Detective file descriptors may remain undeleted.

In certain scenarios, the Security Gateway may fail to apply a new GeoIP database update.

In some scenarios, malicious emails processed by MTA Security Gateways may fail to include the configured custom text in the email body.

In some scenarios, errors in rule number calculation prevented packet tagging from working.

In rare scenarios, the FWK process may exit unexpectedly on the PEP side when Identity Sharing is configured to receive identities from remote PDPs.

In some scenarios, a memory leak may occur in the WSTLSD process when it fails to decode a certificate.

In rare cases, NAT may have been incorrectly identified in specific probing scenarios during HTTPS inbound inspection.

In some scenarios, the Security Gateway may not properly remove closed TCP connections, processed through Active Streaming, from its accelerated connections table if a new security policy was installed beforehand.

In some scenarios, the Security Gateway may restart unexpectedly when passing traffic through LightSpeed hardware acceleration interfaces with SecureXL User Mode enabled.

In some scenarios, the VSX Gateway may experience significant latency when passing traffic between Virtual Systems through a Virtual Router.

In some scenarios, the VSX Gateway may experience poor performance when passing traffic between Virtual Systems through a Virtual Switch with SecureXL User Mode enabled.

In some cases, the ROUTED daemon incorrectly identified itself as a slave on both cluster members after boot, causing ROUTED PNOTEs to remain permanently set.

When receiving an equal-cost LSA from two different ASBRs, only one next hop was previously installed for the route. Now, all relevant next hops are installed.

VLAN filtering was incorrectly enabled on VSNext bridges, causing traffic to be tagged with VLAN 1 or dropped.

Creating a new Virtual System with an automatically assigned ID could fail after a failover, displaying an error that the Virtual System ID already exists.

In rare scenarios, a crash may occur in Traditional VSX during a call to kmem_cache_alloc.

In a rare scenario, the CPU time may be displayed incorrectly.

After backup and restore, Gaia Portal enforces 2FA, but Clish allows password-only login and does not prompt fora 2FA code. Refer to sk184285.

When syslog messages are forwarded to the Security Management Server using the set syslog cplogs on command, they may be misclassified under an incorrect blade instead of Syslog. This misclassification can make it challenging to filter, correlate, and analyze the logs effectively.

The show arp dynamic all Clish command displays (null) MAC address for 15-character IP addresses. Refer to sk185044.

In rare scenarios, the Security Gateway may unexpectedly crash due to timer corruption.

Performance improvements have been made to the VSX interface configuration process.

On Check Point Firewall 3600/3600T/3800 appliances, the fan Speed was incorrectly reported as higher than the maximum threshold value (roughly double the actual value). This was a cosmetic reporting issue, the fan operates normally. Refer to sk185065.

Adjusted the file permissions for systemd service files.

Aligned Gaia Portal behavior with Gaia Clish, allowing usernames to begin with a number in the Gaia Portal.

Updated Neighbor Advertisement logic to set the Router (R) flag to 1 for cluster-generated IPv6 NAs, ensuring RFC 4861 compliance and maintaining stable IPv6 connectivity by preventing hosts from removing the cluster IPv6 Gateway from their Default Router List. Refer to sk185119.

In some scenarios, users can connect to Mobile Access/SSL Network Extender, but do not have access to internal resources after upgrading. Refer to sk185259.

In rare scenarios, the VPND process may crash during Capsule VPN connections that use Mobile Device Management (MDM) compliance and certificate-based authentication.

VPND and IKED processes keep restarting after upgrading in environments with multiple VTI interfaces. Refer to sk184895.

EDPC tunnel establishment failure after MEP failover to a new Security Gateway.

Improved stability for Permanent Tunnel functionality when using Tunnel Test UDP/18234 in Maestro environments.

High CPU utilization may occur without a corresponding indication of heavy web connection load.

Improved IKEv2 stability when handling concurrent IKE messages that share the same IKE cookies.

Added Layer Two Tunneling Protocol (L2TP) stabilization improvement.

In a Traditional VSX deployment, the SD-WAN steering process may generate core dumps, even if SD-WAN is not configured on the machine.

Nightly distribution may fail when no default license pool is set. The system now automatically promotes an available pool during distribution.

NTP may not function properly after an upgrade.

In VSNext environments, creating a management bond interface via gClish using the command add bonding group <Mgmt interface> may fail with the error "this interface is already in use".

After uninstalling an upgrade, the permissions on the $SMODIR/lib directory and related libraries may become more restrictive than required. As a result, the Gaia Portal fails to load pages. Refer to sk185178.