R82.10 Jumbo Hotfix Take 52

Take 52 - New Functionality

PRJ-72371

PRJ-72331

SmartConsole

NEW: Added support for External and others segment in the Policy Auditor.

PRJ-71890

PMTR-131333

URL Filtering

NEW: Optimized the internal URL Filtering cache behavior to reduce browsing latency through Security Gateways with URL Filtering enabled.

Take 52 - Improvements and Resolved Issues

PMTR-134138

PMTR-134407

FMW-11504

PMTR-132772

PMTR-130045

PRJ-74204

ODU-5120

ODU-5113

PRJ-71489

PMTR-129524

Security Management

UPDATE: The zero-phishing-settings API now includes an access control setting that determines which interfaces or sources can access the Zero Phishing portal.

PRJ-70855

PRHF-47086

Security Management

UPDATE: Add increased instrumentation to show LDAP errors.

PRJ-71826

MLS-4020

Security Management

UPDATE: the Cloud Firewall Account Object can now be seen in Object Explorer.

PRJ-72105

PRHF-48120

Security Management

UPDATE: JRE is now updated from version 8.0_8.60 to version 8.0_8.70.

PRJ-71740

MLS-4066

PRJ-72748

MLS-6013

Security Management

UPDATE: Reduced Policy Package cloning time for policies with rulebases containing hundreds of rules.

PRJ-72161

PMTR-115991

Security Management

UPDATE: Sessions with locks or changes can be automatically discarded and logged out. Refer to the CLI Reference Guide.

PRJ-65196

PRHF-42138

Security Management

UPDATE: It is now possible to run the show-access-rulebase Management API command asynchronously using the async-response parameter.

PMTR-132329

PRJ-71802

PRHF-47934

Gaia OS

UPDATE: Updated time zone data for America/Vancouver to align with British Columbia's permanent daylight saving time policy, preventing incorrect local times after November 1, 2026.

PRJ-69168

PMTR-126370

SecureXL

UPDATE: Added support for RARP protocol in UPPAK mode.

PRJ-71586

PMTR-131473

Scalable Platforms

UPDATE: Updated the Unified Configuration behavior in VSX so that newly added virtual systems (VSs) inherit their configuration from VS0 instead of using default values.

PRJ-72964

ODU-4791

PRJ-73654

ODU-4924

PRJ-74228

Automatic Updates

UPDATE: Added Take 180, Take 181, and Take 182 of Web SmartConsole. Refer to sk170314.

ODU-5078

ODU-5065

ODU-4896

PRJ-73785

ODU-4973

ODU-5099

ODU-5092

ODU-4826

ODU-4735

ODU-4784

ODU-4931

PRJ-74232

ODU-5050

ODU-4742

ODU-4889

PRJ-73802

ODU-4980

ODU-5106

ODU-4903

PRJ-71293

PRHF-47213

CPView

In rare scenarios on Maestro VSX Security Groups, the CPVIEWD process may consume high CPU. Refer to sk185220.

PRJ-66738

PRHF-44138

CPView

In some scenarios, improper memory handling causes the CPViewd process to restart unexpectedly.

PRJ-71360

PRHF-45556

CPView

In some scenarios, Security Gateways may experience high CPU utilization due to the cpview_services task.

PRJ-72101

PRHF-47813

Security Management

In some scenarios, an administrator may be unable to log in because the password is unexpectedly rejected. Refer to sk1000158.

PRJ-70211

PRHF-45429

Security Management

In a Multi-Domain Security Management environment that manages a large number of Gateways, memory leaks in the FWM process can accumulate over time, resulting in high FWM CPU utilization, out-of-memory conditions, and Management instability.

PRJ-73062

PRHF-49329

Security Management

In some scenarios, Management or Log Servers may not appear in the "Connected Managements" view under Management & Smart-1 Cloud in the Check Point Portal. This issue can affect cloud services such as SD-WAN and Configuration Sharing.

PRJ-72951

PRHF-41809

Security Management

Threat Prevention policy installation may fail with the "Internal error occurred during the verification process" error when the policy package does not include the Access Control policy.

PRJ-72590

PRHF-48330

Security Management

The Management API may allow users to create host, network, and address-range objects with automatic NAT rules in the Global Domain, even though this configuration is invalid and unsupported.

PRJ-72587

PRHF-47631

Security Management

Editing an administrator account may invalidate its API key if the administrator is configured to log in with an API key.

PRJ-72504

MLS-5297

Security Management

Searching the rulebase by rule name or by the Time column may return inaccurate results.

PRJ-71317

PMTR-131162

Security Management

In some scenarios, after policy installation results in "Succeeded with warnings" status, SmartTask fails to send an email and does not report an error.

PRJ-71035

PRHF-47171

Security Management

In some scenarios, deleting a Security Gateway object associated with a VPN community in SmartConsole may fail.

PRJ-72455

PRHF-48429

Security Management

In a Multi-Domain Security Management environment, the "Match application on 'Any' port when used in 'Block' rule" setting configured in the Global Domain is not applied to local domains after a Global Policy assignment.

PRJ-72520

PRHF-48562

Security Management

Threat Prevention policy installation may fail with the misleading "Internal error occurred during the verification process" error message when the policy contains no enabled rules.

PRJ-71084

PRHF-47243

PRJ-66981

PRHF-44128

Security Management

In a rare scenario, the FWM process on a Multi-Domain Security Management Server may unexpectedly exit and generate a core dump file.

PRJ-71903

PRHF-47761

Security Management

The Compliance report does not accurately report the FW145 check.

PRJ-68663

PRHF-45291

Security Management

The CPM process may fail to start on a Multi-Domain Security Management Server, and the "Failed to load Links Schema from DB to cache" database exception may be logged in the cpm.elg file.

PRJ-72632

PRHF-47989

Security Management

In some scenarios, the CPM process may crash with an "Out of Memory" error during Accelerated Install Policy validation after a large number of policy changes are published.

PRJ-66647

PRHF-44105

Security Management

When a RADIUS role-based user logs in to GuiDBEdit, the system might validate the login against the local database instead of the RADIUS template, causing a local user account to be created.

PRJ-71760

PRHF-47720

Security Management

In some scenarios, administrators authenticated through a SAML Identity Provider cannot open a Security Gateway object in SmartConsole, receiving the error “SmartDashboard component failed to connect to the server". Refer to sk1000067.

PRJ-71557

PMTR-131590

Security Management

Policy installation is not accelerated for Security Clusters.

PRJ-72510

PRHF-47661

Security Management

The Policy Installation window may become slow or unresponsive when a policy change affects a large number of rules in a large rule base.

PRJ-71726

PRHF-47693

Security Management

In Web SmartConsole, editing a Security Gateway object may fail to open the object window, and the navigation pane may become unresponsive until the page is reloaded.

PRJ-72335

PMTR-132285

Security Management

When using the show changes Management API command with the user-changes-only flag, changes made by internal system sessions may be incorrectly included in the report.

PRJ-72451

PMTR-127690

Security Management

On a Multi-Domain Security Management Server, the mdsstat command may show a status of UP (N/A) for CPD in one or more Domains, even though the CPD process is running, as verified by the ps command output.

PRJ-70911

PRHF-40047

Security Management

Security Gateway license information may not be visible in SmartConsole when using Demo mode or when connecting with a read‑only user.

PRJ-70595

PRHF-46492

Security Management

During policy installation, a warning may incorrectly indicate that the libcpatlas.so library cannot be found, even though the installation completes successfully.

PRJ-70859

PRHF-46892

Security Management

The SIDUpdater may stop updating Security IDs (SIDs) for Active Directory objects after encountering an Active Directory entry that no longer exists, causing the remaining objects to retain missing SIDs.

PRJ-71806

PMTR-131699

Security Management

UPDATE: A validation was added to prevent users from adding Domain objects that are not supported by the Cloud Access Control policy.

PRJ-71594

PRHF-47477

Security Management

Replacing a UserCheck certificate with a certificate larger than 1024 bytes may cause SmartConsole to crash unexpectedly.

PRJ-71642

PRHF-47329

Security Management

SmartConsole may unexpectedly crash when importing a malformed PKCS#12 certificate in the HTTPS Inspection configuration.

PRJ-71639

PRHF-47823

Security Management

Fetching Security Gateway interfaces in SmartConsole may fail with the "RunCommandInNgm('CreateNgmInterfacesCommand') failed" error when modifying interface configurations.

PRJ-72527

PRHF-48228

Security Management

In environments with multiple interoperable devices, the "Install Database" operation on a remote server may take a long time to complete.

PRJ-70896

PRHF-46696

Security Management

In Smart-1 Cloud, opening a Shell to a Security Gateway using Actions > Open Shell may fail if the Security Gateway has legacy SSH key-exchange algorithms disabled. SmartConsole may display the error "Connection failed. Make sure there is SSH connectivity between the Management Server and the device..."

PRHF-44260

PRJ-71616

PRHF-47343

Security Management

In some scenarios, the Skyline mgmt_proc_ready metric may stop reporting data.

PRHF-47005

PRJ-72008

PRHF-48002

Security Management

In some scenarios, the Management API may return a "NullPointerException: null" error when retrieving the full details of a policy package. Refer to sk1000079.

PRJ-71115

PRHF-46095

Security Management

When creating a host object through the Management API using an IPv4 address that contains leading zeros (for example, 010.012.023.024), the address may be incorrectly interpreted as an octal value, causing the host object to be created with a different IP address than intended.

PRJ-66207

PRHF-43792

Security Management

In rare scenarios, the CPD process crashes during policy installation.

PRJ-70526

PRHF-46655

Security Management

On a Smart-1 7000 appliance, the systemctl status command may report "State: degraded".

PRJ-66405

PRHF-43750

Compliance

In some scenarios, Best Practice MOB144 returns incorrect compliance results.

PRJ-64428

PRHF-38966

Logging

Users may be unable to filter logs by Syslog severity or facility in SmartConsole and SmartView.

PRJ-71422

PRHF-47173

Logging

Syslog configuration in Clish is missing after the upgrade.

PRJ-72889

PMTR-131371

Logging

In some scenarios, the LOG_INDEXER process may unexpectedly exit and generate a core dump while indexing logs.

PMTR-128790

Sanitized CPView values for CPView history from incorrect updates, including special characters (allow only letters and numbers).

PRJ-72004

PRHF-47662

Logging

In rare scenarios, the FWD process may leak file descriptors in the log-forwarding flow and eventually crash after the descriptors are exhausted, which can also cause the Dynamic Objects process to crash.

PRJ-71324

PRHF-47320

Logging

In some scenarios, the FWD process may crash, and policy installation may fail with the error "Operation failed, install/uninstall has been improperly terminated" when a Log Exporter object is missing its target server, target port, or protocol configuration.

PRJ-71574

PRHF-47551

Logging

In some scenarios, the process that handles OPSEC LEA log export may unexpectedly crash and generate a core dump file while sending logs to an external application.

PRJ-71480

PRHF-41562

Logging

In some scenarios, the SmartEvent correlation process CPSEAD may unexpectedly crash on the SmartEvent server.

PRJ-67363

PRHF-44417

Logging

In some scenarios, the CPLMD process may unexpectedly exit when retrieving log records.

PRJ-64135

PRHF-42185

Logging

In some scenarios, the FWD process may unexpectedly exit and generate a core dump while processing a log that contains a fragment with an invalid length. Refer to sk184948.

PRJ-72011

PMTR-131952

Logging

In some scenarios, Log Sharing does not function on a Multi-Domain Log Server (MLM).

PRJ-72855

PRHF-48346

Logging

In some scenarios, Session logs may be missing in SmartConsole when a connection is matched with both an Identity Awareness or Remote Access VPN user and a Client Authentication or Session Authentication user name.

PRJ-65939

PRHF-39587

Logging

In some scenarios, abnormally high traffic volume values may be displayed in SmartEvent and Check Point Events & AIOps (formerly Infinity Events) traffic-usage views and reports.

PRJ-71972

PRHF-47860

Logging

In some scenarios, VPN Encrypt/Decrypt logs are not displayed in SmartConsole for VPN connections that also include Identity Awareness user information.

PRJ-64853

PRHF-48255

Security Gateway

Improved Anti-Spoofing enforcement for point-to-point interfaces that use IPv4 or IPv6 two-address subnets.

PRJ-68369

PRHF-42979

Security Gateway

Optimized memory/MBuf management on the Security Gateway.

PRJ-66826

PRHF-44124

Security Gateway

When running the show lldp neighbors command in Clish, no output is displayed.

PRHF-39725

PRJ-72671

PRHF-48523

Security Gateway

In rare scenarios, the Security Gateway may unexpectedly crash while inspecting HTTPS traffic associated with the Model Context Protocol (MCP).

PMTR-134044

In some scenarios, very large Network Feeds cause Security Gateway instability or crashes when the feed exceeds the supported limit of 25,000 domains, including Domain objects and their "www." variants.

PMTR-131517

PRJ-72724

PRHF-48959

Security Gateway

After an upgrade, a Security Gateway with 20 or more CPU cores may experience these issues for tens of minutes or even hours after a reboot, cluster failover, cpstart, or policy installation:

• Very high load average, with a single CPU core at 100%.
• VPN tunnels, HTTPS Inspection, or Identity Awareness repeatedly disconnecting and recovering.
• Slow or failed policy installation and, in clusters, unexpected failovers.
• In CPView, one CPU core is saturated while the other cores are mostly idle.

The Security Gateway usually recovers on its own after the traffic load decreases.

PRJ-70497

PRHF-45654

Security Gateway

In some scenarios, the FWK process crashes during inline layer connection rematch due to improper handling of parent rule references.

PRJ-71296

PRHF-47222

Security Gateway

In some scenarios, the C-ICAP process on the Security Gateway may frequently generate core dump files when UserCheck is enabled on the ICAP server.

PRJ-71137

PRHF-46946

Security Gateway

Re-applying an active Suspicious Activity (SAM) rule may reset its expiration earlier than expected.

PRJ-72214

PMTR-132235

Security Gateway

Network Feed (External Feed Object) update logs do not include the "Severity" and "Product" fields that are present in other Check Point security logs.

PRJ-71494

PRHF-47396

Security Gateway

No output is displayed when running the fw cgnat pool <pool_name> command.

PRJ-70710

PMTR-130283

Security Gateway

Some implied rules may incorrectly match traffic based on the Security Gateway's destination IP address, even when the actual destination is a different server that uses the Gateway's IP address as a front-end address.

PRJ-71673

PRHF-47473

Security Gateway

In some scenarios, under sustained file-scanning load, C-ICAP processes consume high CPU and stop responding to new scan requests.

PRJ-66000

PRHF-41802

Security Gateway

Added the kernel parameter fw_fast_accel_log_mode to unify Fast Accel logs with delayed logs, ensuring that the session log includes these entries.

fw_fast_accel_log_mode = 0 - default logging fw_fast_accel_log_mode = 1 - delayed logging fw_fast_accel_log_mode = 2 - no logging

PRJ-67445

PMTR-125132

Security Gateway

Following a Security Gateway upgrade, Network Feed objects may require a manual reset of the update interval and policy reinstallation.

PRHF-47134

PRJ-70514

PRHF-40877

Security Gateway

For traffic processed by Security Servers, destination port NAT is not applied when NAT is configured on the destination port. Refer to sk184158.

PRJ-70497

PRHF-45654

Security Gateway

A potential crash may occur during inline layer connection rematching because of improper handling of parent rule references.

PRJ-63994

PRHF-38457

Security Gateway

In some scenarios, Anti-Virus logs related to ICAP traffic may not be displayed correctly in SmartConsole.

PRJ-70717

PRHF-45845

Security Gateway

In rare scenarios, access to certain websites may fail with the error: "HTTP parsing error occurred: Connection queue exceeded max size". Refer to sk1000292.

PRJ-71799

PRHF-47804

Security Gateway

In a rare scenario, the FWK process may crash while handling Active Streaming traffic.

PRJ-69241

PMTR-127640

Security Gateway

When a Security Gateway uses the out-of-the-box Updatable Objects package as the latest revision, updates may not occur if connectivity is unavailable during policy installation. To ensure Updatable Objects remain current, the system now detects this condition and immediately forces an update instead of waiting for the next policy installation.

PRJ-64066

PRHF-42023

Security Gateway

With the "Same VMAC" feature enabled, the CPView statistics for concurrent connections may become corrupted.

PRJ-65318

PRHF-42747

Security Gateway

In some scenarios, UP_LIMIT drops occur after a failover to a cluster member that has recently rebooted.

PRJ-67601

PRHF-44826

Security Gateway

In some scenarios, the Security Gateway fails to retrieve updates from Check Point services because of proxy configuration issues.

PRJ-71125

PMTR-130358

Security Gateway

When using appliances with four cores (two physical cores), adding the first member to the second site results in a non-default core split of 2/2 instead of 3/1.

PRJ-70425

PRHF-46445

Security Gateway

In some scenarios, the FWK process crashes repeatedly, causing process restarts and potential instability on one or more cluster members.

PRJ-70214

PRHF-46352

Security Gateway

Improved Anti-Spoofing enforcement for point-to-point interfaces that use IPv4 or IPv6 two-address subnets.

PRJ-69100

PRHF-45284

Security Gateway

In some scenarios, users are unable to authenticate via the Captive Portal when TACACS+ authentication is used.

PRJ-69154

PRHF-45608

Security Gateway

In some scenarios, the FWK process may restart unexpectedly.

PRJ-69225

PMTR-127387

Security Gateway

The FWK process may unexpectedly crash during a cpstop operation.

PRJ-70693

PRHF-46904

Security Gateway

Improved stability of the CPRID process.

PRJ-67893

PRHF-44715

Security Gateway

Plane separation in Management Data Plane Separation (MDPS) may be unavailable for non-local users.

PRJ-66202

PRHF-43724

Security Gateway

In some scenarios, the CPD daemon may exit with a core dump file.

PRJ-70964

PRHF-44724

Security Gateway

In rare scenarios, the FWK process crashes, resulting in a VS failover.

PRJ-67896

FMW-8845

Security Gateway

Optimized the shared memory management, which in some scenarios may impact CPU utilization.

PRJ-71782

PRHF-47781

Security Gateway

PRJ-72067

PRHF-47647

Security Gateway

In a rare scenario, cluster members may crash while handling TLS traffic.

PRJ-66769

PMTR-124435

Security Gateway

On Security Gateways with a dual-stack IPv4/IPv6 configuration, in rare cases, the IP lists used by the implied rules are not generated correctly. As a result, the implied rules may not match traffic as expected, potentially causing connectivity issues between the Management Server and the Security Gateway.

PRJ-64050

PRHF-37683

Threat Prevention

In some scenarios, certain websites fail to load because of incorrect handling of the "deflate" response header.

PRJ-69637

PRHF-35363

Threat Prevention

In rare scenarios, the Security Gateway may crash while Anti-Bot is inspecting network traffic.

PRJ-70674

PRJ-70675

Threat Prevention

In certain scenarios, the ioc_search tool may inaccurately report that IPv6 IoC observables are missing from the SecureXL, even when they are actively enforced.

PRJ-71354

PMTR-131334

Threat Prevention

In a rare scenario, the Security Gateway may crash while reporting Anti-Bot events.

PRJ-70536

PRHF-45920

Identity Awareness

Cisco Identity Services Engine (ISE) identity sessions may not match the configured Access Roles when the Group Consolidation feature is enabled.

PRJ-70452

PRHF-46251

Identity Awareness

The PDPD process consumes high CPU in legacy (SIC-based) Identity Sharing flows.

PRJ-71230

PRHF-33065

Identity Awareness

The Portal Title configuration in Captive Portal Customization may not take effect.

PRJ-71101

PRHF-47250

Identity Awareness

The PEPD process may unexpectedly exit while consuming identities from Identity and Trust.

PRJ-67097

PRHF-43970

Content Awareness

APPX packages delivered without the .appx file extension may not be handled correctly by Content Awareness, causing Windows 11 updates to fail.

PRJ-72840

PRHF-48815

Application Control

In some scenarios, SSH and SFTP connections through the Explicit Proxy may be reset immediately after the CONNECT tunnel is established, generating the following log message: "Application Control - Internal system error (4)."

PRJ-69185

PRHF-45463

Application Control

In the Application Control status file (appi_status.C), the status_short_desc and status_long_desc fields are now populated with descriptions that reflect the status of the Application Control update flow. Refer to sk185064.

PRJ-65558

PRHF-42282

Application Control

Policy installation may fail with the “Policy installation failed. error is: Failed to gen PM for context 142, error message: (reference to non-existent subpattern) ...” error when an invalid backreference is configured in the regular expression of an Application/Site object.

PRJ-73398

PRHF-49769

Application Control

In a rare scenario, the Security Gateway may crash with an FWK process core dump.

PRJ-70956

PRHF-47154

IPS

Management server IPS database updates may fail during deployment if the database index contains a corrupted entry with an invalid serialized structure. Refer to sk185174.

PRJ-70496

PRHF-41876

IPS

In some scenarios, IPS may display an incomplete CVE reference number. Refer to sk183974.

PRJ-69151

PRHF-45385

IPS

When specific Threat Prevention blades are enabled on a Check Point Security Gateway, some HTTPS web applications may not render page content correctly. Refer to sk184974.

PRJ-65490

PMTR-119219

IPS

In rare scenarios, Anti-Virus may fail to load an IoC file that contains IPv6 observables.

PRJ-70803

PRHF-46658

DLP

In rare scenarios, a file descriptor (FD) leak can occur in the DLPU process when the flexible hold mechanism is configured for Threat Prevention.

PRJ-72261

PRHF-46265

Anti-Virus

Anti-Virus may allow common file types whose hashes are not in the local database without querying ThreatCloud, even when Deep Scan is enabled.

PRJ-68802

PRHF-45469

Anti-Virus

In some scenarios, Anti-Bot fails to enforce protections against malicious IP addresses when the Security Gateway is configured as an explicit proxy.

PRJ-72446

PRHF-48204

Anti-Bot

In some scenarios, internal networks that span multiple subnets may not be excluded from Anti-Bot email classification. As a result, repeated errors such as "Session is down", "Bad http status: HttpError 502/503", and "Connection timeouts to Resolver.chkp.ctmail.com" may appear in the system logs.

PRJ-73125

PMTR-132933

Anti-Bot

In a rare scenario, the Security Gateway may crash while enforcing Anti-Bot DNS protection.

PRJ-72707

PRJ-72702

SSL Inspection

Improved Security Gateway resilience against HollowByte attacks.

PRJ-72296

PRHF-47640

SSL Inspection

In some scenarios, the FWK process crashes while parsing wildcard certificates (for example, *.domain.com) in HTTPS connections under heavy load.

PRJ-71745

PRHF-47689

UserCheck

"Report wrong category" option in UserCheck may fail with an unexpected error (HTTP error 400).

PRJ-67009

PRHF-44071

UserCheck

PRJ-70293

PRHF-46051

ClusterXL

In some scenarios, NAT64 connections fail on Scalable Platforms.

PRJ-72366

PRHF-44391

ClusterXL

In some scenarios, when QoS is enabled in a cluster environment, the USIM process may crash.

PRJ-71053

PMTR-130311

ClusterXL

In some scenarios, MVC data synchronization fails, resulting in unexpected errors. Under high load, retransmission packets may further impact synchronization and, in extreme cases, cause the old cluster member to crash.

PRJ-69088

PRHF-45320

ClusterXL

In some VSX deployment scenarios, a Full Sync pnote appears on one of the Virtual Systems because automatic SIC renewal by the ClusterXL daemon does not automatically renew SIC on all cluster members.

PRJ-69897

PRHF-46025

ClusterXL

Adding or removing a slave interface from an existing bond after a reboot in VSX ClusterXL can cause a state flap.

PRJ-65982

PMTR-123125

ClusterXL

In some scenarios, the Bridge interface traffic that requires correction may fail.

PRJ-71515

PRHF-47323

SecureXL

The Security Gateway may unexpectedly restart when Jumbo MTU is enabled with the User-Space Performance Pack (USFW).

PRJ-71966

PMTR-131485

SecureXL

PRJ-72019

PRHF-48060

SecureXL

Improved stability of Security Gateway with the Firewall Drop Templates feature enabled.

PRJ-69486

PRHF-45813

SecureXL

In some rare scenarios, a policy installation may cause new traffic to be dropped.

PRJ-70470

PRHF-46594

SecureXL

The SNMP OID fwSXLAggrConnectionsPerSecond returns 0 instead of the actual SecureXL connection rate.

Use fwSXLHostConnectionsPerSecond instead. After installing this Jumbo Hotfix Take, this OID returns the correct value. The aggregate OID is not supported by design because it was intended for legacy multi-device aggregation.

PRJ-68770

PMTR-121802

SecureXL

Implemented memory optimization for jumbo MTU virtual interfaces.

PRJ-71434

^PRHF-47600

SecureXL

In some scenarios, the show interfaces xcvr command reports "transceiver information not available" for ports with a functioning transceiver when UPPAK is used.

PRJ-70615

PRHF-46611

SecureXL

MaaS tunnel communication may fail when traffic is directed to the cluster VIP.

PRJ-72167

PRHF-46308

SecureXL

In an SD-WAN environment, HTTPS traffic undergoing HTTPS Inspection intermittently fails and does not always follow the SD-WAN link selected by the steering policy. Instead, the traffic follows the kernel default route while being NATed behind the IP address of the SD-WAN link chosen by the steering policy.

PRJ-72019

PRHF-48060

SecureXL

Improved stability of Security Gateway with the Firewall Drop Templates feature enabled.

PRJ-70338

PRHF-46353

SecureXL

Improved SD-WAN stability when Forward Error Correction (FEC) is enabled.

PRJ-70629

PRHF-46828

SecureXL

In some scenarios, UDP traffic is displayed in CPView with statistics that use TCP-related terminology.

PRJ-71887

PMTR-131954

SecureXL

A VXLAN outage can occur when upgrading from R82 or lower version because of an incorrect value for the sim_enable_vxlan parameter.

PRJ-65647

PMTR-120046

SecureXL

The first packet of a new IPv6 multicast accelerated connection might be dropped.

PRJ-72408

SMBGWY-13520

SecureXL

A Site-to-Site VPN tunnel may fail to establish, with the message "reason: Virt Defrag Timeout" in the drop log.

PRJ-72363

PMTR-132373

SecureXL

In rare scenarios, a race condition in Maestro deployments can remove a one-time system configuration required for UPPAK mode, resulting in an SGM outage.

PRJ-72417

PRHF-48298

SecureXL

Expanded support for bridged non-IP Layer 2 traffic, allowing the bridge logic to process a wider range of Ethernet frames.

PRJ-73323

PRJ-71748

PMTR-131451

Gaia OS

Improved DHCP Relay handling on VSX clusters, resolving a source-port change (67 to 10467) and providing more stability for DHCP clients behind a Virtual System after an upgrade.

PRJ-71771

PMTR-131804

Gaia OS

A snapshot cannot be reverted to a different appliance of the same model.

PRJ-71692

PRHF-47770

Gaia OS

In some scenarios, after an upgrade from R81.10, the show configuration syslog and show syslog all Clish commands do not display the configured Remote Syslog Servers.

PRJ-70702

PRHF-46164

Gaia OS

In rare scenarios, on Check Point Firewall 3900 Appliances, an SFP transceiver is incorrectly detected as removed and re-inserted, causing a temporary interface link-down event.

PRJ-70511

PRHF-46582

Gaia OS

Improved the SNMP interface description (ifDescr) for newer network interface cards, which no longer display "Unknown device".

PRJ-72611

PRHF-48564

Gaia OS

In some scenarios, SNMP displays an incorrect VS name.

PRJ-70752

PRHF-45870

Gaia OS

Improved Gaia Job Scheduler handling of jobs migrated from R81.10, allowing their settings to be edited after an upgrade. Refer to sk185019.

PRJ-72624

PRHF-48807

Gaia OS

Following a previous incorrect VMAC calculation in ElasticXL VSNext mode, the system now verifies that all Virtual System (VS) MAC addresses assigned to port numbers 8 and higher are correctly configured and consistent across all members.

PRJ-72443

PRHF-47439

Gaia OS

Improved the Gaia REST API on Multi-Domain Servers. API requests are no longer rejected with the error "Invalid X-Forwarded-Host header value" when the request includes the server hostname and port.

PRJ-71343

PMTR-131304

Gaia OS

In rare scenarios, some Check Point Firewall 3970 and 3980 appliances fail to detect certain 10G SFP transceivers, resulting in no link or no port LED indication.

PRJ-71567

PRHF-47476

Gaia OS

After a fresh installation, restoring from a backup may fail.

PRJ-71333

PMTR-131256

Gaia OS

The "RADIUS Host" field in the WebUI previously accepted only IPv4 and IPv6 addresses. It now also supports DNS hostnames (FQDNs), enabling more flexible RADIUS server configuration.

PRJ-71364

PRHF-47460

Gaia OS

In some scenarios, the bond interface loses all slaves when assigned to a Virtual System.

PRJ-70566

PRHF-46625

Gaia OS

Improved Clish logging. The daily "Warning! LOGNAME is missing" message is no longer generated during Health Check Point (HCP) runs.

PRJ-68855

TPDO-10628

Gaia OS

Power Supply LEDs incorrectly show a fault state on Check Point 3900 Appliances with a Single Power Supply. Refer to sk184918.

PRJ-65721

PRHF-43293

Gaia OS

Scheduled backup email notifications are sent for successful Gaia OS backups even when the notification setting was configured to "Send notification if a scheduled-backup is failing." Refer to sk184627.

PRJ-66930

PRHF-44063

Gaia OS

In some scenarios, incorrect CPU usage statistics are displayed by the cpstat command and through SNMP on Maestro systems. Refer to sk184654.

PRJ-71954

PRHF-48025

Gaia OS

Improved the Gaia Clish unlock user command to support locked-out non-local (RADIUS / TACACS+) users.

PRJ-71582

PRHF-47601

Gaia OS

Improved the Gaia Clish show configuration command output to eliminate duplicate interface comment entries for bond member interfaces.

PRJ-71237

PRJ-71622

Gaia OS

Installation history entries may appear in the wrong order because the system sorts records by the date text format instead of the actual installation date and time. As a result, an older installation may incorrectly appear newer in the displayed list. The issue is cosmetic.

PRJ-71132

PRHF-46820

Gaia OS

In some scenarios, repeated "unexpected header length" warnings appear in the snmpd log file.

PRJ-64642

PRHF-38737

Gaia OS

Check Point Firewall 3600 and 3800 appliances continue to send the SNMP Trap "powerSupplyFailure" even after disabling the alarm LED activation as described in sk166000.

PRJ-68493

PRHF-45048

Gaia OS

On Check Point Firewall 9100 and 9200 appliances, the fan frequently receives alerts indicating that its speed is approaching or exceeding the maximum value.

PRJ-70276

PRHF-46153

Gaia OS

Roles configured with virtual-system access: all cannot add global features, such as Backup and Expert, and users assigned to these roles cannot log in. Refer to sk185085.

PRJ-69904

PRHF-45848

Gaia OS

Enabling the fw_link_state_propagation_enabled kernel parameter using the fw ctl set -f int command does not persist. The parameter becomes active temporarily but reverts to its previous value after a reboot. Refer to sk185050.

PRJ-70744

PRHF-46746

Gaia OS

Improved traffic stability after DHCP lease renewal on Security Gateways with Dynamically Assigned IP addresses (DAIP).

PRJ-71945

PRHF-47589

Gaia OS

In some scenarios, DHCP server leases fail when using ClusterXL High Availability (HA).

PRJ-71683

PRHF-47747

Gaia OS

Improved permission handling in the Gaia Portal for non-local administrators (RADIUS/TACACS+) when editing Virtual Systems and ElasticXL pages on VSNext.

PRJ-70883

PRHF-47012

Gaia OS

In some scenarios, the Gaia API proxy fails with "The Gateway does not allow SSH execution" error when its target is specified as an IP address, and another host object is configured with the same IP address.

PRJ-71175

PRHF-45737

Routing

In some scenarios, the VRRP6 kernel module fails to load, resulting in a system failure that causes a boot loop.

PRJ-72922

PRJ-72882

Routing

In some scenarios, files in the /tmp and /var/tmp directories are incorrectly deleted after 10 and 30 days of inactivity, respectively. Refer to sk1000227.

PRJ-70960

PMTR-130588

VSNext

In some scenarios, CPU and memory statistics displayed in CPView and Insights per Virtual System are inaccurate.

PRJ-71442

PRHF-47013

VSNext

Adding or removing interfaces on a Virtual Gateway through the WebUI may fail if the final number of interfaces exceeds 127.

PRJ-71591

PRHF-47485

VSNext

After installing this Jumbo Hotfix Take, if a step in the VSNext Virtual Switch deletion process fails, the system continues with the remaining steps to complete the deletion.

PRJ-72342

PMTR-132314

VSNext

In some scenarios, a memory leak occurs in the CPVIEWD daemon, causing gradual memory growth in the VS0 context on VSNext Gateways.

PRJ-70639

PRHF-46406

Traditional VSX

Improved SNMP daemon (SNMPD) stability during SNMP walk operations performed by third-party monitoring tools.

PMTR-129910

PMTR-134217

PRJ-72377

PRHF-47875

Mobile Access

Improved connectivity and reduced CPU utilization when handling Mobile Access WebSocket-based web applications through the Pinger process.

PRJ-72911

PRHF-49166

Mobile Access

In some scenarios, Mobile Access Citrix applications fail to connect to their servers after an upgrade, and the HTTPD process crashes. Refer to sk1000300.

PRJ-72234

PRHF-48208

VPN

In rare scenarios, the FWK process crashes on a cluster member after it joins the cluster while using Remote Access VPN.

PRJ-72239

PRHF-48242

VPN

In some scenarios, simultaneous VPN tunnel monitoring changes prevent RIM routes from being added or removed for some peers in environments with multiple peers and multiple IKED instances.

PRJ-72535

PRHF-46914

VPN

VPN tunnel statuses are displayed as "Up-Phase 1" in SmartView Monitor. The issue is cosmetic.

PRJ-72129

PRHF-45971

VPN

Enabling the "Exclude external IP from the VPN domain" option may incorrectly exclude the Security Gateway's main IP address, even when it is not configured as an external IP address.

PRJ-71794

PRHF-47786

VPN

In some scenarios, the IKE process crashes during RIM startup.

PRJ-71661

PRHF-47754

VPN

In rare scenarios, a cluster member may enter a boot loop during an upgrade.

PRJ-68245

PRHF-44959

VPN

In a Scalable Platform environment, the SCV policy may not be enforced on any SMO member (the first active member) because the local.scv file was updated only on the SMO and not on all SGMs during policy installation.

PRJ-70724

PMTR-130246

Cloud Firewall

Improved ARP packet processing performance in AWS environments.

PRJ-73065

PMTR-132950

Cloud Firewall

In some scenarios, accessing Gemini in a web browser results in a blank page when HTTPS Inspection is enabled.

PRJ-70866

PMTR-130552

Cloud Firewall

In some scenarios, a Cloud Firewall Gateway intermittently fails to receive its vSEC central license quota during license distribution.

PMTR-130819

PRJ-69514

PMTR-122192

Scalable Platforms

Adding a scheduled backup to an external SCP server may fail with the error: "Remote server identity is not known by Gaia."

PRJ-71322

PMTR-130872

Scalable Platforms

In rare scenarios, an SGM may fail to join a Security Group/ElasticXL cluster and become stuck during boot. The following console message is displayed: "You need to load the kernel first."

PRJ-70577

PMTR-127474

Scalable Platforms

When cluster standby hide mode (fw ctl set int fwha_standby_hide_new_mode 1) is enabled, local connections originating from the data plane (dplane) may fail.

PRJ-67583

PMTR-125793

Scalable Platforms

In some scenarios on ElasticXL deployments, MAC-learning CCP packets are incorrectly transmitted over the slave interfaces of a MAGG interface.

PRJ-71451

PRHF-47349

Scalable Platforms

In some scenarios, in ElasticXL Load Sharing deployments with multiple members on the same site, the pivot member fails to forward or distribute packets to other members, causing traffic disruption.

PRJ-72277

PMTR-132030

Scalable Platforms

In some scenarios, in VSNext environments, virtual MAC address flapping occurs because WRP interfaces of a Virtual System send traffic during Gateway boot before the Virtual System is fully up.

PRJ-72212

PMTR-132212

Scalable Platforms

In some scenarios, after the first policy installation on a newly created VSNext Security Group, non-SMO Security Group members reboot unexpectedly.

PRJ-72062

PRHF-48127

Scalable Platforms

A TACACS+ super-user may not switch the Virtual System context in the Gaia Portal of the Security Group.

PRJ-71841

PMTR-131522

Scalable Platforms

Adding a VTI interface to a Virtual System in WebUI may fail.

PRJ-72432

PMTR-132104

Scalable Platforms

The mass_tunnel interface may not come up during an upgrade when management traffic is routed through a data interface, causing policy installation to fail. Refer to sk184660.

PRJ-72224

PMTR-132214

Scalable Platforms

In some scenarios, a Security Group Member that fails to retrieve its configuration from the SMO may not perform the scheduled automatic reboot and may remain in the DOWN state until it is rebooted manually.

PRJ-68699

PMTR-126579

Scalable Platforms

In some scenarios, non-SMO members may remain in a down state with a "Configuration" pnote because of a falsely detected configuration mismatch in the fwkern.conf and simkern.conf files after kernel parameters are migrated to the Unified Configuration database.

PRJ-69400

PMTR-128427

Scalable Platforms

In some scenarios, an upgraded Security Group Member may fail to fetch the policy during the first boot because the policy fetch process starts before the management interface is up.

PRJ-71716

PMTR-131742

Scalable Platforms

In VSNext and ElasticXL environments that use Svmac and a bonded VLAN interface as the management interface, MAC flapping may occur.

PRJ-69976

PMTR-129142

Scalable Platforms

SGMs may go down with a "Configuration" pnote because the robo-IKE.NDB file is not distributed correctly to all ElasticXL members.

PRJ-71829

HEC-3404

Scalable Platforms

On Maestro, the "SNMP Per Member" feature may fail to be enabled in Traditional VSX mode.

PRJ-71029

PMTR-123014

Scalable Platforms

On Scalable Platforms, during a Multi-Version Cluster upgrade, the set cluster members-admin-state Gaia gClish command and the equivalent WebUI action could not activate an upgraded member. Only the clusterXL_admin up Expert mode command was supported.

PRJ-72158

PRHF-48179

Scalable Platforms

Changes to SMS, Log, or Email notification modes in the asg alert tool are not applied when switching between enabled and disabled states. The configuration must be deleted and reconfigured for the changes to take effect.

PRJ-71651

PMTR-120914

Scalable Platforms

In some scenarios, Virtual Systems with IDs greater than 255 do not start correctly and are assigned the Default Filter Access Policy.

PRJ-70819

PRHF-46381

Scalable Platforms

The asg vsx_verify command may falsely report a "Mismatch" for correctly configured VTI interfaces (vpnt*) on VSX Scalable Platforms.

PRJ-64872

PRHF-21006

Carrier Security

GTPv1 traffic may be dropped with code description "Invalid IE length value", "GTP info: Parsing IE type 133 failed".

PRJ-72796

PMTR-132256

SD-WAN

In a Multi-Domain Security Management Server with a Global VPN Community, changes to a Security Gateway configuration in one Domain are not reflected when a policy is installed on a Security Gateway in another Domain.

PRJ-71339

PMTR-131289

Hardware

In some scenarios, transceiver hot-swapping between different speeds does not work due to firmware remaining in a stale state, requiring a reboot for the transceiver to function correctly.