List of All Resolved Issues and New Features in R82 Jumbo Hotfix Accumulator

UPDATE:

• Resolved CVE-2026-50751 - User Authentication bypass on VPN Remote Access and Mobile Access in deprecated IKEv1 key exchange. Refer to sk185033.

• Resolved CVE-2026-50752 VPN site-to-site certificate bypass vulnerability in deprecated IKEv1 key exchange. Refer to sk185035.

NEW: Policy Auditor is a policy analytics and auditing tool that provides visibility into traffic behavior within the user's network. In SmartConsole > Security Policies > Access Control, Policy Auditor presents a matrix view of the network's logical segments and the access rules defined between them. The tool allows administrators to audit these security rules and verify that they align with organizational access policies and segmentation requirements.

• Requires R82 SmartConsole Build 1065 or higher.

NEW: Introduced the new Migration Tool for converting ClusterXL to ElasticXL. Refer to sk183894.

NEW: Added integration between the Security Management Server and Illumio to extend Check Point micro-segmentation capabilities. This integration enables importing Illumio Workloads and Labels into SmartConsole and using them directly in the Access Control Policy. It improves policy visibility and operational awareness, with enforcement performed on the Security Gateway without requiring an additional policy installation. Refer to R82 CloudGuard Controller Administration Guide > CloudGuard Controller for Illumio Policy Compute Engine.

UPDATE: Resolved CVE-2026-48131 - VPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero. Refer to sk184981.

UPDATE: Resolved CVE-2026-48133 - Identity Awareness Captive Portal - Unauthenticated Local File Inclusion. Refer to sk184993.

UPDATE: Resolved CVE-2026-48135 - HTTP service can incorrectly process malformed HTTP requests. Refer to sk184991.

This Jumbo Hotfix Accumulator Take includes dozens of code and functionality hardening changes.

UPDATE: JRE is updated from version 8.0_8.50 to 8.0_8.60.

UPDATE: In environments with thousands of Domain objects or External User Groups, the policy installation duration is now significantly improved.

UPDATE: When connecting a Domain to the Check Point Portal, Dedicated Log Servers in the Domain are now connected automatically.

UPDATE: The Zero Phishing Software Blade improvements:

• Changed the default Portal Accessibility configuration from "Through all interfaces" to "Through internal interfaces", including the VPN-encrypted interfaces.

• Resolved an issue that prevented saving manual updates to internal accessibility settings. Refer to R82 Threat Prevention Administration Guide.

Requires installing R82 SmartConsole Build 1065.

UPDATE: Added a capping status indicator to CPView and SmartConsole showing whether log sharing is actively sending logs to the Cloud or it reached its daily limit. Refer to R82 Security Management Administration Guide.

UPDATE: When OCSP certificate validation fails, the Security Gateway now automatically falls back to CRL validation. Manual configuration via the Check Point Registry (described in Scenario 2 in sk179434) is no longer required.

UPDATE: Added the ability to automatically stop kernel debugging after a specified number of seconds. See the R82 Quantum Security Gateway Administration Guide. Refer to the command "fw ctl debug -T <Number of Seconds>".

UPDATE: Added an ability to automatically roll back CoreXL instance changes on a VS if the operation fails on one of the cluster members.

UPDATE: Added support for Microsoft Azure Network Adapter (MANA) driver. Refer to sk183754.

UPDATE: New features and improvements are released in Take 163, Take 165, Take 170 via self-updatable package. Refer to sk170314.

UPDATE: Added Take 53 to Log Exporter Auto Update Deployment. Refer to sk182866.

UPDATE: Added Take 43 of Check Point Support Data Collector (CPSDC) for Scalable Platforms and Maestro Security Appliances. Refer to sk164414.

In rare scenarios, CME (Cloud Management Extension) fails to run because of the "show-simple-gateway" Management API command failure. The CME logs show such entries: "Product - CMESeverity - criticalDescription - Error during synchronization with Security Gateways. Error details: Failed to scan for gateway instances in the cloud account".

Policy installation may fail when an inline layer is used more than once in the same policy and this error is displayed "Policy installation had failed due to an internal error. If the problem persists please contact Check Point support".

In a Full High Availability (HA) ClusterXL deployment, the Check Point Portal does not display the Active Management Server as connected. As a result, Configuration Sharing is not working as expected in the Check Point Portal.

The delay may be observed during the "compiling policy" and "generating policy files" stages in SmartConsole.

When using the "add/set data-type-weighted-keywords" and "add/set data-type-file-attributes" Management API commands, the field "description" is missing from the response.

SMB packages may not appear in the Multi-Domain Security Management "package repository list", even though they uploaded successfully.

In SmartTask-generated emails, the Sender field displays the username instead of the user's email address.

In rare scenarios, the /var/tmp directory may be filled up with redundant tmpUserDefineCmd_OS0*.sh files, created during Compliance Software Blade scans.

In some scenarios, an upgrade of the Security Management Server may fail with a "There can only be one Automatic Purge Setting for this domain. Duplicates are invalid" message.

• The fix will only be applied if the upgrade to this Jumbo Hotfix Take is done using a Blink image or with the Advanced Upgrade method.

The "set-checkpoint-host" Management API command with the "interfaces" field may fail with the "generic_err_invalid_parameter" error.

Upon creation of a new Domain on a Multi-Domain Security Management Server, the Domain Server's virtual IP address is not added to the Gaia database, making it inaccessible via Clish commands. Refer to sk183941.

In some scenarios, the Management Server may generate excessive log messages, causing the cpm.elg log file to reach its size limit quickly.

In some scenarios, the Domain Log Management Server fails to connect to the Check Point Portal.

Apostrophes used in CPView strings cause CPDiag to fail. CPView History data is not shown. Refer to sk184873.

In SmartView Monitor, opened from Logs & Events > Tunnel & User Monitoring, the "SmartEvent Correlation Unit" status may be displayed as "Not running" although the CPSEMD process is running.

In the "HTTPS Inspection Statistics" in SmartView, filtering by the "bypass_reason" field returns no results.

In some scenarios, incorrect values are shown in the "Total Bytes" field in the logs. Refer to sk184237.

In the Connection logs, the Source Country and Destination Country fields may contain missing or incorrect values.

In some scenarios, non-ASCII characters may appear garbled in SmartEvent Automatic Reaction emails.

Changing instances on Virtual Systems may not trigger synchronization flows in some relevant directories and in the High Availability module.

In rare scenarios, after an upgrade, the Security Gateway may crash because of a missing route.

In a rare scenario, an incorrect zone assignment occurs when NAT Rule Base returns HOLD. Refer to sk184530.

In rare scenarios, the FWK process may unexpectedly exit when the Anti-Bot Software Blade inspects a specific malformed domain.

Running the "g_tcpdump mcap" with "-C" flag fails with the file matching or captured packets merging error.

During a ClusterXL High Availability failover, the FWK process may unexpectedly exit when processing Web Security traffic.

In some scenarios, SNMPv3 monitoring fails on Data Plane when MDPS is enabled. Refer to sk184379.

Enabling ForceAuth for Remote Access VPN fails because of a typo in the saml_force_authn_override.sh script (sk182042).

In scenarios where a network connection is closed before the Anti-Virus ThreatCloud emulation or scanning response is received, the affected session may experience connectivity instability.

In some scenarios, non-accelerated traffic from a Standby VSX Cluster member may not be routed to the correct virtual instance on the current Active member when SecureXL User Mode (UPPAK) is enabled.

In some scenarios, when processing HTTPS traffic in the accelerated pipelined path, the FWK process may unexpectedly exit.

In Smart-1 Cloud environments, the "Threat Prevention" view may display 0 in the "Logs" column under the "Top Protections" widget. Refer to sk184505.

In a rare scenario, the Threat Prevention rule base may fail to match traffic to any rule.

When the Packet Tagging feature is enabled on the Full Identity Agent, new user and machine identity sessions reported to the Identity Awareness Gateway may not be assigned the correct Access Roles. As a result, traffic from these sessions may not match Access Control Policy rules that use access roles with Packet Tagging enabled.

In a rare scenario, when the fetch_by_SID feature is enabled, the PDPD process repeatedly exits. Refer to sk182745.

In some scenarios, a memory leak may occur in the DLPU process. The /var/log directory on the Active Cluster member reaches critical disk usage levels.

In a rare scenario, when using Dynamic URL List, updating the version file may result in a FWK process restart.

In some scenarios, changes to the kernel parameter "dlpk_drv_default_queue_sz" may not take effect.

In some scenarios, the Security Gateway may drop DNS traffic with non-malicious Domains.

After an upgrade, the Mobile Access Software Blade's CVPND daemon fails to load and the Mobile Access Portal becomes inaccessible when adding new Virtual Systems or converting to a VSX Gateway, due to improper updates to the gateway-side configuration file cvpnd.C. Refer to sk183293.

Connections with fragmented packets drop on Scalable Platform/Maestro when there are multiple active Security Group Members (SGMs) on the site. Refer to sk182559.

After creating a High Availability ClusterXL and syncing to Smart-1 Cloud, running the "get interfaces with topology" in Smart-1 Cloud may cause the Sync interface to be removed from the Cluster object.

In rare scenarios, CPHASTART, CPHACONF, and CPHAMCSET processes may intermittently unexpectedly exit.

IPv4 addresses in the SYN Defender Allow List in SmartConsole may be loaded with the address octets reversed.

Changes to the SYN Defender Allow List made in SmartConsole may not override or replace local modifications made directly on the Security Gateway.

When using DoS Deny List and running "cpstop", an error message may be displayed, and a memory leak may occur.

A failed Access Control policy installation may block future installs until the Security Gateway is rebooted, even after the original issue is resolved.

In some scenarios, when installing a policy fails, the Sand Blast Security Gateway becomes unresponsive and reboots automatically. The "Installation failed. Reason: Due to a timeout value of 600000 (millisecond) (port) (IP), Security Management Server aborted the connection with the peer" error is displayed in SmartConsole.

In some scenarios, the USIM_X86 process may become unresponsive.

The USIM process may exit with core dumps when debug information is collected.

When the Security Gateway is working with SecureXL in User Mode (UPPAK) mode, in some scenarios, the USIM process may exit and not restart, although it should.

When configuring PIM in Sparse Mode across multiple Virtual Systems on a VSX Security Gateway, the Security Gateway may crash, resulting in loss of connectivity.

When SecureXL User Mode (UPPAK) mode may be disabled if some scripts are incorrectly edited.

When SecureXL works in User Mode (UPPAK) on Security Gateways with CPAC-4-10F-C interface modules, invalid Ethernet frames permanently shut down the port's transmit queue, causing complete connectivity loss.

A ROUTED daemon may exit with a dump file during an OSPF route lookup on a route being redistributed between BGP and OSPF.

A VSX Security Gateway may drop traffic with IPv4 options or IPv6 extension headers arriving from a Virtual Switch (VSW) interface.

When MDPS routing separation is enabled, Link Layer Discovery Protocol (LLDP) fails to be enabled from Gaia Portal.

LLDP data formatting issues when querying using SNMP. Refer to sk183733.

On a Scalable Platform Security Group, although an SHA hash type was configured for Gaia OS passwords with the Gaia Global Clish command "set password-controls password-hash-type", the Gaia Global Clish command "set expert-password" saves the password as an MD5 hash in the Gaia OS database. Refer to sk182339.

The SSHD process unexpectedly exits on the Multi-Domain Log Server (MLM) after an SSH session ends. Refer to sk183972.

Upon logging in to the Gaia Portal, the login page accepts the credentials, briefly displays the homepage, and then automatically redirects back to the login screen.

Custom log rotation configured using Gaia OS does not apply to SAML-related log files, so these logs are not rotated automatically. Refer to sk113241.

Cloning groups may fail during configuration updates. Refer to sk184701.

VPN traffic outage may occur in ClusterXL environments with SD-WAN Overlay or Enhanced Link Selection after a Cluster failover. The new Active cluster member fails to properly handle VPN traffic because of synchronization or MAC address handling problems.

SSL Network Extender Portal is accessible even when it is disabled in SmartConsole. Refer to sk184344.

The VPND daemon intermittently exits after a downgrade.

Remote Access Endpoint Security Client may fail to connect.

The VPND and IKED daemons keep restarting after upgrading to R82 in an environment with multiple VTI interfaces. Refer to sk184895.

In some scenarios, over time, prolonged VPN traffic may lead to gradual memory growth.

VPN traffic outage may occur in ClusterXL environments with IKEv2 after a Cluster failover.

After a Cluster failback, RDP (Routed Data Path) or DPD (Dead Peer Detection) probing may not be triggered, which can result in traffic continuing to use outdated Multiple Entry Point (MEP) Gateway selections.

In environments where all Security Gateways are configured with IPv6 addresses only, Site-to-Site VPN connectivity may be disrupted when Enhanced Link Selection is enabled.

The IKED process may exit when the traffic is passing through IKEv2 tunnels.

Enhanced Link Selection configured with Auto Next Hop uses invalid IP addresses, preventing tunnel initiation.

IKE daemons may fail to start on Cluster members without generating dump files.

A malformed or incorrect interface name in the "cphaprob -a if" command on VS0 triggers a fatal error in the cluster process, causing the member to go DOWN and generating a core dump.

After upgrading the firmware, the interface on one of the VSX cluster members may go down.

Deleting a Virtual Switch (VSW) may break connectivity for unrelated Virtual Systems (VSs).

The Netscout feature may not monitor network connectivity to remote known hosts on VSs other than VS0.

When adding or deleting static routes in the huge VSX environment (more than 50 Virtual Systems and hundreds of static routes), VS creation fails with "Unable to watch directory /etc/routed-mc-enable: init: Too many open files". Refer to sk181317.

In VSNext ElasticXL and VSNext Maestro, running the "cpconfig" command from Clish/gClish within a Virtual System context may trigger execution in the Global context.

When capturing packets on a warp interface in a Virtual System (VS) of a VSX Security Gateway with SecureXL User Mode (UPPAK) enabled, certain reply packets may not be captured, for example, ICMP Echo Replies to traffic directed at the Security Gateway.

When the Same VMAC Mode is enabled on ElasticXL, VS0 may lose connectivity (SSH).

The FWM may unexpectedly exit when attaching a license to a Security Gateway using vSEC license distribution (vsec_lic_cli).

Registration of Data Center assets with a numeric, non-UID unique identifier may fail, potentially causing performance impact on the Security Management Server.

VPN traffic outage may occur in ClusterXL environments after a Cluster failover.

In rare scenarios, SD-WAN objects (such as Peer VPN Domain, My VPN Domain, or SD-WAN Internet) may be incomplete, causing SD-WAN rules to match traffic incorrectly. Refer to sk184814.

Security Gateway may drop legitimate H323 traffic with "Illegal H.225(Q931) No Q.931 User-user IE found". Refer to sk184591.

In a Maestro environment with Multi-Domain Security Management and enabled MDPS, SNMP per member queries do not survive member failover. Additionally, SNMP queries to the SMO may be routed to the dplane instead of the mplane.

A Security Group Member may enter a continuous boot loop after the other members were upgraded. An incorrect image file (with an invalid or mismatched MD5 checksum) is presented on the Single Management Object (SMO). As a result, the problematic member fails to complete the autoclone and repeatedly reboots.

Using a unique IP address with the Same VMAC feature enabled may cause connections to the Standby unique IP address to fail.

In DNS per-Virtual System (per-VS) mode, the DNSMASQ process may allocate ports outside the defined local port pool, potentially resulting in dropped DNS traffic.

When an upgraded site holds the initial connection, subsequent site failovers may cause out-of-state packet drops.

When "g_ClusterXL admin up" is triggered from a non-VS0 member (for example, VS1), the command fails and the upgraded site remains down with a pnote.

After creating a light snapshot locally, the snapshot appears in the output of "show lightshots", but the /mnt/lightshot directory is empty. When attempting to export the snapshot using the "set snapshot-onetime export <Snapshot-Name> target local path <Local-Path>" command, the operation fails with the "General Rsync failure" error.

After creating a bridge interface using Gaia Portal and rebooting, the Security Gateway state is down.

These actions applied through the Web Portal are not applied to all Security Group members, but only to the SMO:

• create/delete/edit scheduled backup

• edit mail-address/notification-level for mailing

• delete backup

In a rare scenario, when a VPN-corrected packet is dropped, the packet truncation warning "14 bytes missing" may be seen in the "tcpdump" output.

OSPF adjacencies repeatedly disconnect in a VSNext Cluster. Refer to sk184396.

On a Maestro dual-site environment, the sgm_pmd core dump file may be generated after the Jumbo Hotfix Accumulator installation. There is no functional impact.

Bond interface deletion or IP address change may cause a site failover.

In ElasticXL setups, it may not be possible to add a second Sync interface to the bonding group.

After joining a VSNext ElasticXL member to a second site via automation, a pnote for the management (magg1) interface appears under vs0 in "cphaprob -a if", instead of under Virtual Switch (vswOID) as expected.

GTP-U intra-tunnel packets may be dropped with "Packet too short" and "Invalid IP packet" errors in Bridge Mode, preventing proper inspection of encapsulated traffic.

UPDATE: Added Update 4 of Server-Side Change Report Generator Release Updates. Refer to sk179508.

UPDATE: Added Take 223 of CPotelcol (OpenTelemetry Collector) Release Updates. Refer to sk180522.

UPDATE: Added Take 60 to Log Exporter Auto Update Deployment. Refer to sk182866.

UPDATE: Added Update 26 of HealthCheck Point (HCP) Release. Refer to sk171436.

File downloads may get stuck at 100% completion when either the Anti-Virus or Threat Emulation Software Blade is actively scanning the file.

See the Critical Information section.

NEW: It is now possible to add host/network/range objects for split tunnel on exclusion/inclusion modes. Refer to R82 Remote Access VPN Administration Guide > Dynamic Split Tunneling for SaaS Using Updatable Objects.

NEW: Now you can manage Harmony SASE Internet Access policy and HTTPS Inspection policy directly from SmartConsole. By centralizing policy management, the integration ensures consistent policy enforcement across products, streamlines governance for security policies, and consolidates operations into one trusted, management platform.

UPDATE: Check Point response to Apache Tomcat CVEs on Harmony Endpoint Security Management Server - CVE-2025-31651 and CVE-2025-31650. Refer to sk183615.

UPDATE: Policy verification error messages are now improved for scenarios when verification fails because of updatable objects, dynamic objects, and Domain objects in a Remote Access VPN community.

UPDATE: Added ability to use the '.', '@', '~', ',' characters for non-local users using the Clish command "set aaa allow-unsanitized-username enable <all/dot/at/comma/tilde>". Refer to sk183201.

UPDATE: Added support for reusable target profiles to the Lightshot snapshot configuration.

UPDATE: Added ElasticXL support for Virtual Machines on Mixed Appliances. Refer to sk183513.

Administrators with LSM write permissions cannot delete LSM Gateway objects without also having write permissions for Others/Common Objects.

Importing a large policy package fails with validation and API errors on the Multi-Domain Security Management Server. Refer to sk183697.

In some scenarios, when Configuration Sharing is enabled, audit logs may show failed login attempts to the CPM Server after publishing changes.

In rare scenarios, after an IPS update, all protections are set to Staging mode in Threat Profiles configured with "Set activation as Staging mode".

In some scenarios, creating a Standby Domain Security Management Server fails with a "You do not have the permissions to complete this action" message.

VMcore crashes may occur with core dumps of the LOG_INDEXER, LOG_EXPORTER, and JAVA processes on the Security Management Server, causing high CPU utilization.

When running the "mgmt_cli -r true gaia-api/set-ntp target pocsms enabled true --format json" Management API command, the output is not the same as running it directly from Gaia API. Refer to sk184510.

In some scenarios, Compliance Software Blade presents the results of Firewall Best Practices as "N/A".

On Multi-Domain Security Management Servers, custom Compliance Software Blade Best Practices may differ between the Multi-Domain Security Management level and the Domain level.

CPView may display incorrect concurrent connection statistics (negative values) because of improper aggregation of connection data during a Cluster failover.

In some scenarios, exporting logs to CSV in SmartView fails and the LOG_INDEXER process unexpectedly exits. Refer to sk184475.

The FWK memory leak may occur during FTP connections with high file volume. Refer to sk183662.

When changing the CoreXL configuration (for example, adjusting the number of SND and FW instances), a network interface may unexpectedly go down. This can cause traffic disruption.

In some scenarios, when SecureXL is working in User Mode (UPPAK) mode, QoS service is unable to start, displaying the "QoS is not responding. Verify that QoS is installed on the gateway" error. Refer to sk183752.

When using a Security Gateway as a Proxy "Non-transparent" and HTTPS Inspection is set to "inspect" with "X-Forward-For header", video playback on YouTube fails.

See the Critical Information section.

A PYTHON3.11 zombie process may be running in the background without impact on system performance.

SSL Network Extender (SNX) package installation fails with a verification error.

Mobile Access SSL Network Extender (SNX) remote users with Windows 11 24H2 fail to connect. Refer to sk182923.

Concurrent NAT64 and NAT46 operations may cause packet processing threads to become unresponsive because of improper issue handling in the SIM v6 kernel module.

Traffic may be disrupted when reconfiguring the virtual hardware interfaces.

The USIM process may exit when multiple routes are using the same nexthop and the nexthop is not yet resolved

The USIM process may exit during the FWK restart.

The USIM process may exit while configuring a PPPoE interface using Gaia Portal.

Multiple threads may be performing a routing next hop lookup for the same next hop at the same time, causing a rare race condition and USIM-related processes to exit.

In a Maestro setup, the USIM process may exit under high load when handling encrypted VPN traffic with the other Security Gateway.

In some scenarios, the Security Gateway may crash.

VPN traffic outage may occur in ClusterXL environments after a Cluster failover.

A race condition may cause the PROBEMOND process to exit during policy installation when VPN network probes are removed/added.

Services fail after Virtual System failover in Maestro dual-site environment using the Same Virtual MAC feature. Refer to sk183956 and sk184194.

In a Maestro environment, Security Group member may not be in the ACTIVE state with an Active Distutil PNOTE raised.

The LLDP Clish "lldpneighbors" command may have a corrupted output in case of extensive data. Refer to sk182065.

The MONITORD process unexpectedly exits on Security Gateways. Refer to sk184076.

Restoring backup using Gaia Portal (or gClish) when there is a single member in the Security Group fails.

A Virtual System may lose connectivity on the Backup and the Standby member when route-based traffic is configured with specific SD-WAN configurations in VSX environments.

Posture Management scans initiated manually or automatically remain stuck at the "Scan initialize" status. This issue affects all devices with Endpoint Security installed.

Security Management Server and Policy Server may lose connectivity after uploading production licenses. Running "cplic print -x" on the Policy Server shows no output, while the Security Management Server output is uploaded for review.

Security Gateway cannot fetch the QoS policy from Security Management. Refer to sk183709.

Traffic impact on a Maestro Gateway with the MDPS feature enabled during a major version upgrade to R82.

The "hcp -r" Orchestrators Ports Link Integrity test does not report link integrity issues when there is a bad signal on the MHO physical ports.

When Maestro Fastforward feature is enabled, policy installation may fail with "Maestro acceleration (MXL) failed, reason: General error. Please check /var/log/acl_cli.log on the security group SMO for more details" instead of indicating that it is a policy parser issue.

After an upgrade, a local connection from Standby members on the VS management interface fails.

In rare scenarios, in a Maestro setup, traffic interruption may occur after Security Gateway reboots when the Gaia Database is corrupted.

Installing policy to the Maestro Security Group under extreme load with Resource Separation may fail.

Policy installation fails with an internal error when the Security Gateway policy includes rules that match a specific Access Point Name (APN) for GTPv0 or GTPv1 traffic.

UPDATE: Check Point response to CVE-2019-6109, CVE-2019-6110, CVE-2019-6111. Refer to sk65269.

UPDATE: SmartTasks are now supported in the System Domain of Multi-Domain Security Management. This feature enables the automation of system-domain operations, reducing manual tasks and enhancing reliability. Refer to R81.20 Quantum Security Management Administration Guide > Preferences and Management Settings > SmartTasks.

UPDATE: Improved shared memory packet flow and performance.

UPDATE: Added Take 77, Take 78 and Take 80 of Policy Insights Release Updates. Refer to sk183421.

UPDATE: Added Update 24 of HealthCheck Point (HCP) Release. Refer to sk171436.

UPDATE: Added Take 210 of CPotelcol (OpenTelemetry Collector) Release Updates. Refer to sk180522.

In some scenarios, the warning "Threat Prevention Policy: For better performance, blade exception rules with the action 'Inactive' should be placed above other exception rules" appears in SmartConsole even though no exception rules violate the recommended configuration.

In rare scenarios, High Availability synchronization may fail with a connectivity error.

On the Multi-Domain Security Management Server, when staging is cleared for an IPS protection in the Global Domain, any staging configuration for the same protection in the local Domain (within a Global profile) remains unchanged during policy assignment.

In a Multi-Domain Security Management environment, when opening the License tab of a Security Gateway object in SmartConsole, the "Security Gateway was not found" error may be shown.

The Configuration Sharing feature does not work as expected with VSX Gateways on a specific Domain.

When the Gaia Portal accessibility is configured as "According to Firewall policy", access may be denied because of a match on an implied rule with the "Accept" action.

Threat Emulation on ICAP Server fails with "There was an Unexpected Internal error, Please try again later". Refer to sk184228.

In some scenarios, when HyperFlow is enabled, websites that use HTTP2 protocol do not load properly.

When a Security Gateway is configured in Bridge Mode, a memory leak may occur.

In rare scenarios, the Anti-Virus Software Blade fails to fetch the external intelligence feed because of an authentication failure.

In Azure Active Directory, access role assignment only evaluates the first 100 group memberships for a user. Group memberships beyond this limit are ignored when determining access roles. Refer to sk183328.

In rare scenarios, IoC resources are not loaded or distributed as expected.

In some conditions, the Packet Capture may be missing from IPS logs in SmartConsole.

When using MDPS with IPv6 disabled on the Security Gateway side, the Security Gateway may leak IPv6 packet buffers instead of dropping them. Refer to sk184419.

Security Gateway unexpectedly crashes with kernel logs showing segmentation faults in the USIM_86 process. Refer to sk184340.

In some scenarios, there is significant latency when passing traffic through bridge interfaces configured on a Security Gateway when SecureXL User Mode is enabled.

In a rare scenario, packets with malformed message headers cause the Security Gateway to crash.

In some scenarios, a VSX Gateway may not optimally pass traffic from a Virtual System to a Virtual Router or Virtual Switch when connections are accelerated in SecureXL.

When tunnel is established and traffic is running, the USIM process may exit every 15-20 minutes and cause a failover of the second member.

In some scenarios, when a Security Gateway, running in SecureXL User Mode (UPPAK), receives IPv6 Neighbor Discovery Protocol (NDP) packets from the network, it may not properly forward or process them correctly.

Running the "set igmp interface <ifname> last-member-query-interval <value>" command may fail with a syntax error.

In a VSX setup, when Dynamic Balancing is enabled and an Elephant Flow is running, only one firewall instance may remain active to handle the rest of the traffic.

In large scale environments, the "cpstat vsx" commands sometimes take a long time to execute or fail.

The FWK process may exit with core dumps during VS creation or deletion.

On VSNext ElasticXL setups with more than one Virtual System and IPv6 enabled, SSH disconnections occur because of wrong MAC address assignment to WRP interfaces.

Registration of an updated Data Center asset to the Security Management Server may fail.

In rare scenarios, new connections may continue matching "Prioritize Local Breakout" despite low ISP quality that should trigger a switch to backhaul.

OTV switches drop unknown unicast packets (packets with destination MAC addresses not present in the MAC address table) instead of forwarding them, resulting in traffic loss.

In rare scenarios, "asg stat -i chassis_monitor" returns "0" even when the cluster did not start, causing "distutil" to incorrectly update the MHO topology. This can result in a traffic impact when a cluster member recovers from a FWK process exit.

The Insights tool may not represent data on Virtual Systems.

On VSNext ElasticXL setups with IPv6 enabled, multiple WRP interfaces may be assigned the same link-local address, potentially causing network connectivity issues and routing failures.

Running the command "ccutil ssm_exec 1 'show system uptime'"generates no output.

NEW: Hardened the authentication in the Gaia Cloning Group.

Important - After the installation of this Jumbo Hotfix Accumulator Take, you must follow these steps in each current Cloning Group:

1. Make sure this Jumbo Hotfix Accumulator Take is installed on each Cloning Group Member

2. On each of the Cloning Group Members, enter a Cloning Group password - enter the current password again or a new password.

3. On each Cloning Group Member, re-synchronize the Cloning Group.

For more information, see the Gaia Administration Guide > Chapter "System Management" > Section "Cloning Group".

UPDATE: A Security Management Server/Domain Management Server can now manage up to 1500 Security Gateways/Cluster members, allowing concurrent policy installation on all Security Gateways/Cluster members at once.

UPDATE: Added an HCP test to check whether the CPAC-2-100/25F, CPAC-2-100/25F-B, CPAC-2-40F-B, or CPAC-2-40F-C FW firmware is safe to update from R81.10 to a higher version. Refer to sk182403.

UPDATE: The "tops" calculation method is now consistent between SmartConsole and Management CLI (mgmt_cli), so both tools produce matching results.

UPDATE: ISP Redundancy is now supported in VSNext Mode.

UPDATE: Added Identity Awareness metrics to Skyline. Refer to the Skyline Metrics Repository.

UPDATE: SecureXL Rate Limiting rules for DoS Mitigation now support these parameters with automatic IP range updating enabled by default:

• "cc:<COUNTRY_CODE>"

• "asn:<AUTONOMOUS_SYSTEM_NUMBER>"

Refer to sk112454.

UPDATE: CPView now monitors the Quantum Maestro backplane interfaces, Sync, and Chassis Internal Network (CIN) interfaces.

UPDATE: Added Take 50 of CPquid (QUID) Release Updates. Refer to sk181458.

UPDATE: New features and improvements are released in Take 149 and Take 150 via self-updatable package. Refer to sk170314.

In rare scenarios, the FWM process on the Security Management Server may unexpectedly exit, creating a core dump file because of the incorrect license update.

In rare scenarios, the User Check policy is not updated during the Accelerated Policy installation.

When migrating a Security Management Server to a Multi-Domain Security Management Server more than once, the operation fails with the "got at least one duplicate UID in requested list" error.

Security Management Server upgrade may fail when running out of memory.

In rare scenarios, discarding an old session fails with an "An internal error has occurred" message.

When updating a VSX cluster configured as a Central Office Gateway through SmartProvisioning, the SmartProvisioning application displays "Server is disconnected. SmartProvisioning will be terminated" and crashes.

In CPView, under Network > Traffic in Concurrent Connections table, the amount of non-TCP connections is higher than shown in the output of the "fw ctl pstat" and "fw tab -t connections -s" command. The issue is cosmetic only.

Intermittent drops of transmission packets for "Streaming Engine: TCP Invalid Retransmission" causing HTTP loading issues. Refer to sk181282.

The RAD daemon may unexpectedly exit on VSX Gateways.

In Maestro Dual Site in the VSX VSLS mode, although CoreXL Dynamic Balancing is enabled, CoreXL does not change the number of Firewall instances and SND instances during traffic load. Refer to sk183485.

HTTP/2 connection may fail when Threat Prevention Software Blades are enabled with Deep Inspection because of a protocol error. Refer to sk183822.

In a rare scenario, the DLPU process may exit during traffic inspection when holding a connection.

Users on shared Servers (MUH v1 and v2) cannot access resources they should have permission to use. When this happens, the Security Gateway fails to recognize the user's identity and does not apply the correct access permissions. Refer to sk183268.

In rare scenarios, the source IP shown in the IPS detection log is invalid. Refer to sk182914.

In a rare scenario, the memory consumption of the DLPU process continuously increases.

In some scenarios, the Anti-Virus Software Blade reaches a timeout when inspecting Domains because of latency in the RAD daemon.

In cluster environments using Bonds and VLANs, the ClusterXL Monitoring command "cphaprob stat" (Expert Mode) and the Clish command "show cluster state" may display an incorrect failover reason when an interface disconnects or a link goes down.

A rare race condition occurs during "cpstart" command execution in VSX environments that prevents proper sync interface installation, specifically in the cluster flow process, causing synchronization problems between cluster members.

6in4 tunnels are shown in Down state when monitored using the "cphaprob -a if" command.

SecureXL does not immediately send packets to the appropriate handler when it receives packets from a Virtual Router or Virtual Switch and fails to forward them to the connected Virtual System. This delay causes significant routing delays and potential routing errors on VSX Security Gateways.

The link on the 4-Port 10/25GbE CX7 Lightspeed Network Interface Card may fail to establish when multiple 4-port CX7 Lightspeed Network Interface Cards are installed.

When SecureXL User Mode (UPPAK) is enabled, there can be a significant latency on a Security Gateway when opening an FTP data connection.

The USIM core file may be generated when rebooting the Security Gateway.

In a specific scenario, where SSM static groups are configured on an interface, after a failover, these IP addresses do not appear as Outgoing Interfaces (OIFs).

IKEv2 negotiation and Child SA re-keying processes may experience instability during Remote Access VPN connections.

The "vsx-provisioning-tool" CLI command returns asynchronous task IDs before it is ready for monitoring, causing Terraform and similar automation tools to immediately fail when attempting to track task status.

After installing a Jumbo Hotfix Accumulator R82 Take 14 and higher, assigning an IPv6 address to the SMO interface fails.

When using Resource Separation on MDPS on Maestro, and the Security Gateway is under extreme load, policy installation fails, although the Resource Separation should handle the load.

The "See more information in Gaia updates" link in CPUSE is broken.

SNMP query for "vsxStatusInterfaceRxBytes" and "vsxStatusInterfaceTxBytes" OIDs returns "0". Refer to sk183871.

In rare scenarios, in a VSX Cluster running in VSLS Mode with Identity Sharing configuration, CloudGuard Controller may send identities to the VS IP address and not the Cluster IP address, causing Security Gateway update failures.

In rare scenarios, after an upgrade, installing an Access Control policy in an SD-WAN cluster environment causes the Standby member to transmit probes and may cause traffic disruption.

When handling multiple shared uplinks across numerous interfaces, errors related to LACP bond uplink updates may be printed in logs.

When the Maestro Fastforward feature is enabled, rebooting a member may cause the member to be down because of the policy installation failure and the "Site HA module not started" error may be displayed.

Security Group members may reboot because of cp-nano database entries. The /var/log/configuration_reboot_reason.log may show "process:cp-nano-watchdog" when database entries exist only on the local member or only on the SMO member.

During an upgrade process, a member gets stuck in the DOWN(TpPolicy) state although Threat Prevention is not configured in the environment.

The minimum and maximum thresholds are incorrectly reported (the values are flipped) for PMIC-3 1V sensor readings in MHO-175.

After adding a custom command in Gaia gClish with the "add command", the custom command is available only on the Single Management Object (SMO). Refer to sk178671.

Quantum Maestro Orchestrator Gaia Portal may become inaccessible after installing R82 Jumbo Hotfix Accumulator Take 41 or Take 43.

See the Critical Information section.

UPDATE: Resolved CVE-2025-2028. Lack of TLS validation when downloading a visualization support data file. Refer to sk183349.

NEW: Web SmartConsole now supports Quantum Spark Gateways and Security Gateways with a Dynamic IP Address (DAIP).

UPDATE: Added a new Clish command "cplic ignore_expired_ngtx 1" that allows administrators to disable license status monitoring for expired Next Generation Threat Extraction (NGTX) licenses in SmartConsole. Run the "cplic ignore_expired_ngtx 1" command on each Cluster Member or Virtual System that reports an error and restart with the "cpstop;cpstart" command.

UPDATE: Added new Management API commands to configure synchronization with User Center: "show sync-with-user-center" and "set sync-with-user-center" which was previously only configurable through the SmartConsole GUI. Refer to sk94064.

UPDATE: JRE is updated from version 8.0_8.26 to version 8.0_8.35.

UPDATE: Improved the "fw tab" CLI command help by adding descriptive explanations for each option.

UPDATE: URL Filtering provides now better categorization for non-inspected HTTPS connections by proactively re-validating certificates before the "Categorize-HTTPS" cache entry expires.

UPDATE: In the Gaia Portal login, added support for the period character (".") in RADIUS and TACACS usernames. This feature is disabled by default. Refer to sk183201.

UPDATE: Added option to use the local IP address 127.0.0.1 for license creation for Maestro Security Group members.

In SmartConsole, deleting a license in the Licenses tab of a Security Cluster object fails with the "Domain Management Server licenses cannot be removed from the Domain Management Server level" error.

In rare scenarios, login to the Security Management Server may fail with timeout.

Policy installation is delayed because of the FWM process load. Refer to sk183563.

Reassigning Global Policy takes a few hours after updating IPS Snort protections.

SAML authentication fails for Web SmartConsole on port 4434, redirecting to an invalid URL (https://localhost:4434:4434/smartconsole/transport) and preventing SSO login, while SmartConsole GUI authentication works normally.

Compliance scan finishes successfully but does not show any data in SmartConsole.

The Management API command "add-custom-ca-certificate" may fail with a "general error" if the administrator does not provide the Base64-certificate parameter.

In some scenarios, the "where-used" Management API command with details-level set to "full" may fail with a "generic_internal_error" message, if the queried object is part of a Threat Prevention Exception Group.

The FWM daemon may leak and then exit.

In the Compliance view, when clicking the picker in the "Source" or "Destination" columns while creating a custom Firewall Best Practice, the network objects list shows "Loading" and loads slowly.

When viewing certain reports in SmartView, the "No data found" error may appear even when matching logs exist.

In the CPView > Network > Templates > Accept-Templates, the concurrent templates may have a bogus value such as 18,466,744,073,709,551,585.

Missing cleanup when template connection creation fails prevents the system from exiting new connection context mode, causing subsequent connection operations to write incorrectly to the cache instead of the connection table.

VSEC licenses may be automatically deleted and re-added on the Security Management Server (SmartCenter in Azure), creating duplicate license strings with mismatched signatures and causing intermittent "License with CK already exists" errors.

In rare scenarios, the WSDNS daemon may exit instead of shutting down gracefully.

The Clone Policy Package task in SmartConsole fails with the "The object name must not contain whitespace characters at the beginning or the end" error. Refer to sk161294.

The SAML authentication flow may fail on a VSX Gateway.

After upgrading the Security Gateway to R81.20 Jumbo Hotfix Accumulator Take 92, Remote Access IPSec VPN connections using Endpoint Security VPN E88.60 fail. Authentication succeeds, but all client connections through the Security Gateway are dropped by the Cleanup Rule.

In rare scenarios, the local connection route may be incorrect when the ICAP client is active.

Disk space may not be cleared as expected when Content Awareness is the only enabled Software Blade.

In rare scenarios, the FWK process may crash when the URL Filtering Software Blade is enabled.

A potential memory leak because of many DLP/FILE_CONVERT processes spawned.

Virtual System in a VSX VSLS Cluster does not fail over when a cluster interface goes down. Refer to sk182734.

When the Security Gateway runs in User Mode SecureXL (UPPAK), removing a VLAN impacts connectivity on other VLANs in Bridge mode that share the same physical interface.

The multicast stream may not resolve correctly in VSX topologies. Packets are dropped with the "IP multicast routing failed (missing OS route)" message.

Rare VPN connectivity issues caused by Encryption Domain overrides in communities with third-party Gateways.

In some scenarios, the FWM process exits during VSX provisioning, and the VSX Provisioning operation fails. Refer to sk184502.

The Security Gateway may crash when recreating a Virtual Gateway.

The 1.3.6.1.4.1.2620.1.6.7.5.1.5 SNMP OID (multiProcUsage) reports wrong values when HyperFlow is enabled.

SNMP Agent may report a wrong value for VLAN Interface Speed.

If the User Center connection fails, contracts may be retrieved incorrectly, resulting in erroneous contracts getting pushed to the Security Gateway.

In Gaia Portal, there is a hardcoded maximum limit of 32 firewall instances for CoreXL configuration, although the correct maximum should be based on the actual number of CPU cores available on the machine.

Policy installation may fail on newly added Security Group members because an updatable object package is missing.

The CPVIEWD daemon may exit on a VSX Gateway.

In some scenarios, SmartConsole does not display logs from the Multi-Domain Log Server and Multi-Domain Log Modules after an upgrade to R82. Refer to sk183783.

See the Critical Information section.

NEW: In SmartConsole, the CSV export file of Access Control Policy NAT rules now contains the hit count data: "Hits", "First Hits" and "Last Hits" columns.

• Requires R82 SmartConsole Build 1056 or higher.

NEW: Added support for the Quantum Spark 2500 appliances (2530, 2550, 2560, 2570, and 2580) in the EA (Early Availability) program.

• Requires R82 SmartConsole Build 1057 or higher.

UPDATE: Resolved CVE-2025-2028. Lack of TLS validation when downloading a visualization support data file. Refer to sk183349.

UPDATE: In SmartConsole and Management API, Access and NAT Policies now support Rule Base search for hitcount values.

UPDATE: On Security Management Servers, environment variables set using the override_server_setting.sh script now apply to all processes. Refer to sk165938.

UPDATE: In SmartConsole > Logs & Monitor > Logs, added information to the "Per Session" logs:

• NAT fields

• Dynamic object name

• Updatable object name

• Network feed object name

• Destination Domain Name field

UPDATE: Quantum Force 9400 and 9300 appliances with Standalone configuration now run in User Space Firewall (USFW) Mode by default.

UPDATE: Added the "inclusions" feature to the Split Tunnel Remote Access functionality. Refer to the R82 Remote Access VPN Admin Guide > Dynamic Split Tunneling for SaaS Using Updatable Objects.

An FD (file descriptor) memory leak may occur when creating a new object in SmartConsole.

The "Management rejected fetch for this module - version matching problem" error is displayed when running the "fw vsx fetch" command on an R81.x Scalable Platform (Maestro and Chassis) in VSX mode with an R82 Security Management Server. Refer to sk183298.

Fetching branches from an LDAP Server fails with "Failed to connect to LDAP Server. Please ensure that the administrator's credentials are correct and try again" when the LDAP Server does not support anonymous bind (when a client connects to an LDAP server without providing any credentials). To enable the ability, refer to sk183461.

Deleting a user that is used in a user group with more than 1000 users may cause SmartConsole to time out.

In some scenarios, when exporting the Gateways and Servers View to CSV, the resulting file may contain an extra empty column. Refer to sk182233.

In some scenarios, policy installation fails with the "/opt/<xxxxx>-R81.20/conf/Policy-name.pf" line N: ERROR: syntax error Error compiling IPv6 flavor. Operation ended with errors" error.

In rare scenarios, accelerated policy installation fails to initialize, the full Access Control Policy installation is executed instead and it may take up to 20 minutes.

The "vsx-run-operation" Management API command may fail on the Multi-Domain Security Management Server. Refer to sk182524.

In some scenarios, the Postgres database on the Standby Security Management Server is growing after every High Availability synchronization. Refer to sk182868.

The "show lsm-gateway" and "show lsm-gateways" Management API commands may return an empty "version" field.

In rare scenarios, Domain creation fails with "Failed to create Domain server '<Domain Server Name>'. The connected administrator has no permission to create a Domain-Server on the specified Domain".

CPView history may be corrupted.

When the Mirror and Decrypt feature is enabled, the SKB memory leak may occur.

In a rare scenario, the CPD daemon may exit on the Security Gateway.

In rare cases, failovers may occur because the FWK process unexpectedly exits.

When handling interface statistics, the CPD or FWK processes may unexpectedly restart with an error related to IOCTL printed in logs. Refer to sk183544.

In rare scenarios, the FWK process may unexpectedly exit when stopping the Security Gateway using the "cpstop" command while a packet capture tool is running.

In rare scenarios, the FWK process may unexpectedly exit when the IPS Software Blade logs triggered protections.

The VSX Security Gateway may crash when an external interface connected to the Virtual Router or Virtual Switch starts flapping.

In some scenarios, external IoC feeds are not correctly fetched in VSX environments after a reboot.

In rare scenarios, Security Gateways with the Content Awareness Software Blade enabled may fail to properly process certain .zip file formats, resulting in "Failed to process files" errors during the Anti-Virus inspection.

In rare scenarios, the RAD process may unexpectedly exit.

The "HTTPS Inspection Statistics" view in Demo Mode of SmartView in SmartConsole shows " No data found". The issue is cosmetic only.

The ROUTED daemon may incorrectly initialize as Subordinate rather than Master after a "cpstop;cpstart" command when executed on the sole Active member in a cluster configuration.

In High Availability Bridge Mode ClusterXL environments, the management interface of a Standby member becomes inaccessible. Refer to sk183124.

When printing the Deny list on a Security Gateway during Threat Prevention policy installation after deleting a large IoC feed from Security Management, an uninformative IOCTL error is displayed instead of a proper error message. The issue is cosmetic only.

In a rare scenario, no traffic is passed in the 6in4 tunnel and the two hosts cannot reach each other. The output for the "tcpdump" command in the tunnel shows "ip: unknown ip 0".

In rare scenarios, when SecureXL works in User Mode, running the "reset_gw" or "vsx_util reconfigure" commands may cause the Security Gateway to crash.

Multicast traffic is dropped when the Packet-Broker operates in Monitor Mode with Promiscuous Mode disabled.

After MTU for Jumbo Frames is configured on a physical interface for the first time, until the Security Gateway is rebooted, there may be potential packet drops.

Stability issue on Quantum Force appliances 9300 and 9400. Refer to sk183438.

SNMP OID .1.3.6.1.4.1.2620.1.6.7.5.1.5.X falsely reports high CPU due to malformed calculation. Refer to sk182784.

The ROUTED daemon core dump file may be generated because of an assertion failure in the OSPF code.

In a rare scenario, a Security Gateway crash and temporary loss of routing adjacency occur when the cluster messaging system attempts to process a deletion request for a BFD session that no longer exists.

If BFD (Bidirectional Forwarding Detection) timing parameters, such as "min-rx-interval", are modified during an active BFD session deletion process, and a new BFD session is established before the deletion fully completes (deletion typically requires up to 2 hours), the newly created session inherits the previous timing configuration rather than applying the updated timing settings.

In some scenarios, BGP routing updates may not be processed properly.

NFS mount does not support hyphen "-".

In rare scenarios, when using IP Aliasing, deleting an interface by IP address reference may incorrectly delete the wrong IP address because of incorrect error handling.

VPN connection may be unstable because of packet fragmentation issues.

Virtual Router advanced routes may be assigned incorrect priorities in policy-based routing configurations.

The "vsx_util view_vs_conf" command output may show "N/A" for a Gateway when an object in the Domain shares the same name as the Virtual System object.

In a large scale VSNext environment, creating over 50 Virtual Systems (VSs) fails.

SD-WAN policy installation may fail during the configuration of MDPS on the Security Gateway.

In a Maestro environment, migrating a Virtual System between Security Groups may cause a member to crash.

After a reboot, IPv6 addresses configured on data interfaces disappear from the "ifconfig" output when the Same VMAC feature is enabled in SmartConsole.

Running "cpstop" on a specific Virtual System may cause traffic interruption in dual site deployments.

DHCP broadcast packets are not visible on the intended VLAN when working in SecureXL User Mode (UPPAK). Refer to sk183675.

In a VSNext setup, Virtual Gateways (except VS0) cannot establish SIC connectivity with the Security Management Server.

See the Critical Information section.

NEW: Added support for Quantum Smart-1 700-S, 700-M, 7000-L, 7000-XL, 7000-UL. Refer to sk182601.

NEW: This Take introduces a fail-open mechanism for HTTPS Inspection with Hardware Security Module (HSM) integration. If the HSM becomes unavailable, TLS connections now automatically bypass HTTPS Inspection, ensuring continuous network connectivity.

UPDATE: A patch on top of OpenSSL 1.1.1w to fix CVE-2024-13176. Refer to sk183168.

UPDATE: Added the "Type" and "Resource" columns to the HTTPS Inspection Logs table under Logs & Events.

UPDATE: Added support for using Network Groups in the "Install On" column of the NAT Policy. Refer to sk176846.

UPDATE: Added a count of Session and Connection logs to the "cpstat" command output.

UPDATE: Support TLS 1.3 for the RAD process requests. To activate it, change the TLS version to "TLSv1_3". Refer to sk178505.

UPDATE: Added a kernel parameter "domo_reverse_lookup_disabled" to disable reverse DNS lookups to avoid rare incorrect matches in scenarios involving non-Fully Qualified Domain Name (non-FQDN) Domains.

• "domo_reverse_lookup_disabled 1" to disable reverse DNS lookups.

• "domo_reverse_lookup_disabled 0" to enable reverse DNS lookups (the default value).

Refer to sk120633.

UPDATE: HTTPS Inspection statistics are now available through SNMP requests.

UPDATE: Added support for the Mobile Access Portal "WebSocket" applications to work in environments with asymmetric network bandwidth (the download speed is faster than the upload speed) between external and internal networks. Refer to sk95311.

UPDATE: Added selection of specific Security Gateways to onboard to the Infinity Portal, and the ability to disable the feature completely. Refer to sk180557.

UPDATE: In the Clish API, added the comprehensive VSNext task monitoring capabilities, previously available only in the Gaia Portal.

UPDATE: Rather than using the management switch, it is now possible to choose a different management interface for each virtual system (VS).

UPDATE: Traffic between an external network host and an internal network host is now accelerated when a static NAT is configured to translate a cluster member's IP address or specific high port to an internal host IP address or specific service port. This scenario is relevant in Check Point CloudGuard Network Security Azure High Availability deployments, where traffic passes through a Load Balancer.

• To enable acceleration, add this kernel parameter to the $FWDIR/boot/modules/fwkern.conf file - "accel_dnat_to_cluster=1".

• The change can also be applied immediately to the running FW1 process without requiring a reboot: "fw ctl set int accel_dnat_to_cluster 1".

In SmartConsole, in the Gateways & Servers view, under Device & License Information of a Security Gateway or Cluster object, or in CPView and SNMP traps, the value of "new connection rate" for OID .1.3.6.1.4.1.2620.1.1.26.11.6.0 is incorrect.

In rare scenarios, a core file of the CPRLIC process is generated.

Login using a TACACS Server created with the "add tacacs-server" Management API command, fails with "authentication to server failed".

Creating a Threat Prevention Exception from a log fails with the "Failed to add exception" error when the "File Name" field in the log contains a Windows directory separator ("\").

In some scenarios, Web SmartConsole session gets disconnected after several minutes.

In rare scenarios, when more than one Security Blade is enabled on the Security Gateway, Presets for policy installation may fail after purging all revisions.

When using SmartWorkflow on a Security Management Server with more than 200 administrators, requests may stall or cause SmartConsole crashes during submission.

Access Control Policy installation may take a long time when updatable objects are used in the policy.

In rare scenarios, login to SmartConsole using LDAP, TACACS or RADIUS authentication fails with a timeout.

Global Policy Reassignment fails with the "org.postgresql.util.PSQLException: ERROR: more than one row returned by a subquery used as an expression" error printed in the cpm.elg file.

In rare scenarios, policy installation fails with "Policy installation had failed due to an internal error".

When modifying the URL definition type in an Application Site object using the "set application-site" Management API command with the "urls-defined-as-regular-expression" parameter, the type of pre-existing URLs remains unchanged.

In some scenarios, policy state directories are synchronized between Active and Standby Security Management Servers, leading to high disk space usage.

Duplicated licenses on the Security Management Server may impact the vsec_lic_cli utility.

In some scenarios, opening a specific VPN community in SmartConsole fails and the "Unable to load page" message is printed, while other communities can be opened.

If a custom login message exceeds 1000 characters, the login output file, which contains the sid and other session data, cannot be parsed as expected. Using the "mgmt_cli" with the "-s" parameter results in the "Failed to parse login output file" error.

When a Security Gateway object is deleted, its license may still appear as attached even though the Security Gateway Object no longer exists.

In a rare scenario, December date comments in the IPS User Settings view may display incorrect year.

In a Multi-Domain Security Management environment, RADIUS authentication may be sent with an incorrect IP address. Refer to sk180723.

In a Multi-Domain Security Management environment with a VSX Gateway, such operations as login to SmartConsole, Global Domain Assignment, Domain creation or deletion may take longer than expected or fail with a timeout message "Task failed".

In certain scenarios, when Cluster objects are used in a Multi-Domain Security Management Server with Domains that have Global Domain Assignments, an upgrade may fail with "Tried to persist object OBJ_ID with domain 1e294ce0-367a-11e3-aa6e-0800200c9a66 while active domain is DOMAIN_ID".

• The fix will only be applied if the upgrade to this Jumbo Hotfix Take is done using a Blink image or with the Advanced Upgrade method.

Policy installation fails on all Domains on the Multi-Domain Security Management Server with "Layer '<LAYER NAME>': Verification failed due to an internal error" if an Externally Managed Security Gateway object with IPsec enabled does not have an encryption Domain. Refer to sk183003.

Multiple errors "T_get_event: cannot register socket %d (%d sockets already registered for %s)" are printed in $MDSDIR/log/ in.msd.

Interfaces with VLAN are not visible in CPView stats.

When opening a log card in the Logs View, duplicate values may appear in the "Resource" and "Reason" fields.

The "fileapp_parser_get_attribs: call orig_get_attrib failed" error is printed in the $FWDIR/log/fwk.elg file.

VoIP H.323 calls are dropped with reason "Handler 'h323_h245_code' reject". Refer to sk182835.

In a rare scenario, when the Anti-Virus Software Blade and the ICAP Server are enabled, there may be high CPU usage.

Local connections originating from the Security Gateway may fail to refresh their timeout values.

In rare scenarios, HTTPS inspection may block the downloading and uploading of PDF files to and from the Web Server.

In a specific scenario, file downloads intermittently stop until resumed manually because of HTTP parsing issues and Content Awareness parsing failures.

The DSD process (Dynamic Split Daemon) may exit when the "affinity" command input is large.

In a rare scenario, the FWK process may unexpectedly exit and bring down the Security Gateway.

• The CPD or FWK process may unexpectedly restart when handling the interface statistics.

• The CPVIEW_SERVICES, RAD, SNMPD and VPN processes may exit with a core dump file because of memory corruption.
  Refer to sk183544.

A rare race condition may cause a Security Gateway to restart when updating the statistics.

In rare scenarios, Security Gateway may crash when running the "ethtool -x" or the "ethtool -X" command for an interface that uses the AWS ENA network driver.