R82 Jumbo Hotfix Take 118

NEW: Permission profiles for Access layers via the Management API are now supported. A new field, "additional-permission-profiles", has been added to the existing "add/set access-layer" Management API.

For example: mgmt_cli set access-layer name "Network" additional-permission-profiles.1 "custom_profile"

NEW: Added the option to send Gaia backup to a Remote Server using the SFTP protocol. This feature also supports restore operations via SFTP and scheduled backups (including retention policy support).

• For information about regular backups, refer to R82 Gaia Administration Guide > Maintenance > System Backup > Backing Up and Restoring the System.

• For information about scheduled backups, refer to R2 Gaia Administration Guide > Maintenance > System Backup > Configuring Scheduled Backups.

NEW: The Virtualization Screen is added to VS0 Insights, displaying Virtual Systems statistics, including Virtual Systems problem detection, alongside general environment metrics and the Resource Search tool.

• Resource Search Tool: Provides a cross Virtual Systems interface search capability.

• Problem Detection: Introduces Virtual System problem indicators in the Status and Problem Categories columns, showing problem classifications. Users can select a Virtual System row in the Virtual Systems table to re-launch Insights in the Virtual System context and investigate issues in AI Detector.

NEW: Added a configuration option for Maestro Orchestrator to forward Spanning Tree Protocol (STP) BPDUs to Maestro Security Group Members. Refer to sk185110.

UPDATE: Check Point Response to CVE-2026-31431 (Copy Fail), CVE-2026-43284, CVE-2026-43500 (Dirty Frag) and CVE-2026-46300 (Fragnesia). Refer to sk184928.

UPDATE: In environments with thousands of Domain objects or External User Groups, the policy installation duration has been significantly improved.

UPDATE: Resolved CVE-2026-62144 - Management Authentication Bypass and Privilege Escalation. Refer to sk185152.

This Jumbo Hotfix Accumulator Take provides additional Management and Gateway hardening fixes, including VPN Site to Site and Remote Access.

UPDATE: Added Take 89 and Take 90 of the AutoUpdater Utility. Refer to sk165653.

UPDATE: New features and improvements are released in Take 171, Take 173, and Take 176 of Web SmartConsole. Refer to sk170314.

UPDATE: Added Take 13 and Take 75 of Smart-1 Cloud MaaS Tunnel. Refer to sk166056.

UPDATE: Added Take 57 and Take 59 of CPquid (QUID) Release Updates. Refer to sk181458.

UPDATE: Optimized Mobile Access policy installation to improve performance in environments with a large Mobile Access Rule Base (more than 500 rules).

UPDATE: Resolved the Mobile Access Portal XSS vulnerability in the PHP file.

UPDATE: These deprecated VSLS commands were removed as not supported:

• "set cluster vsls system primary_site"

• "show cluster vsls system primary_site"

UPDATE: Old SVMAC feature is now deprecated ("toggle_same_vmac" parameter is blocked). Only use the new SVMAC feature ("toggle_same_vmac_os"). Refer to sk165674.

UPDATE: Global parameter "fwha_grade_should_consider_lacp" is now disabled by default.

In the VLAN interface, CPView shows the speed of the parent.

The FWM process may exit because of memory exhaustion and generate large core files (up to 4GB).

Using the "get Interfaces without topology" option on a Security Gateway may remove user-defined interface comments and color settings. Refer to sk180516.

In rare scenarios, the Security Management Server fails to start after performing a "Revert to Revision" operation.

In some scenarios, Multi-Domain Security Management HA synchronization may fail after AI Copilot permissions are updated, until a manual synchronization is performed. Refer to sk185124.

Packet mode search does not return results for Inline Layer rules in SmartConsole and Management API. Refer to sk184638.

In some scenarios, the FWM process on the Security Management Server may unexpectedly exit when performing the "Fetch branches" action in the LDAP Account Unit properties window of SmartConsole.

In some scenarios, running the "api stats" command with the "-calc_avg_duration" flag on the Security Management Server fails with the "IndexError: list index out of range" error. Refer to sk184144.

In some scenarios, opening a Security Gateway object in SmartConsole fails with "Smart Dashboard component failed to connect to a server".

In some scenarios, accumulated open sessions can cause the Security Management Server to become unavailable.

In rare scenarios, the FWM process on the Multi-Domain Security Management Server may not stop after running mdsstop.

A SmartTask configured to send an email after policy installation may fail when the target gateway is a VSX object.

SmartConsole may display the error "the user already exists" when attempting to create a new administrator with the same name as a previously deleted SAML (Identity Provider) administrator.

In some scenarios, the automatic update of Data Center assets fails. Refer to sk184316.

In some scenarios, the "show simple-gateways" Management API command fails with "Object not found - Can't find BlobAuthKey object with hash ID=' '." error message.

Configuration sharing from a Management Server to the Check Point Portal may fail with a "Did not get reply from Docker" error.

In some scenarios, fwmtrace.log* files consume a significant amount of disk space.

The Management API v2 command "show-vpn-communities-star" with details-level full may fail with an "Internal error" message when a Virtual System Cluster member is configured as a satellite in a VPN Star community.

A temporary fix related to the QUID identity database (used by CPDiag and AIOps) caused issues in Maestro environments and led to degradation and occasional agent resets in AIOps, as it relies on this component as its IdentityDB. The fix has therefore been removed.

High load on the LOG_INDEXER process may impact system performance.

The logs maintenance is running perpetually and is not clearing disk space when the CPPCAP (Check Point Traffic Capture Tool) is enabled.

SmartEvent processes may unexpectedly exit in environments containing over 1 million network objects.

Active Streaming Layer connections become stuck, resulting in increased memory consumption over time on the Security Gateway. 

On ClusterXL and in Maestro Security Groups, after performing a rolling upgrade that includes a change in the CoreXL instance count, newly created firewall instances may remain in local-sync-only mode. As a result, these instances do not receive state updates from their peers, leading to intermittent connection failures and "First packet isn't SYN" drops. Refer to sk184786.

The memory usage may increase over time when using the Mirror and Decrypt feature.

FTP traffic does not pass through Security Gateway when using the FTP Extended Passive Mode. Refer to sk183853.

In a rare HTTP/2 traffic scenario, a valid connection may fail.

In rare HTTP/S inspection flows, the Security Gateway may crash if there is a parsing error.

The message "ws_mux_handle_dpi_jobs: async_params has no pm or hash job" can be printed in the fwk.elg log file when passing HTTP traffic.

In some scenarios, internal memory mishandling in global connections may cause unexpected behavior or connectivity issues.

In some scenarios, active connections using HyperFlow are closed following a crash of the dmd_run process, and the FWK process may also crash. This error appears in the dmd.elg file: "mux_dmd_handle_errors_from_dmd: Handling errors from DMD. error SESSION_COLLISION".

After an upgrade, the "show configuration" command output for MDPS may be missing bond configuration.

FTP transfers of files smaller than 1KB fail and result in empty files on the destination server. Refer to sk184200.

Some service ports may be missing in some instances, resulting in unexpected behavior for some services.

In a rare scenario, the FWK process crashes when the Mirror and Decrypt feature handles large MTU frames.

There may be high CPU usage by the CMID process when the ICAP Client is enabled on Security Gateway. Refer to sk184524.

When processing CIFS IPv6 traffic in the accelerated pipelined path, the dmd_run process crashes. HyperFlow is not supported for CIFS over IPv6.

When ESP traffic is present in the environment, and the fwmultik_dispatcher_in_tap_mode parameter is enabled, the Security Gateway may drop ESP traffic.

In rare scenarios, the Anti-Virus fails to inspect HTTP file downloads.

SSH connections may fail after enabling SSH Deep Packet Inspection (DPI).

In some scenarios, HTTP file downloads fail with a connection timeout when both Threat Emulation and Threat Extraction are enabled.

In some scenarios, enforcement of an Indicator of Compromise (IoC) feed containing mail observables may fail if the feed file includes a single malformed entry because of a parsing error.

The default role in Aruba Networks ClearPass CPPM does not match the identity sessions.

The Microsoft Graph API access token does not renew if an authorization error occurs while working in on-demand fetch mode.

In some scenarios, the PDPD process stops responding and users cannot authenticate through the Identity Awareness. Refer to sk184407.

When using custom applications and SD-WAN, HTTPS traffic may be blocked with "Reason: Application Control - Internal system error" in SmartConsole log.

RAD request drop may occur in rare case header includes unsupported characters.

In some scenarios, the Packet Capture option is missing from IPS logs in SmartConsole.

A memory leak may occur in the parsers_is TLS module when HTTPS Inspection is enabled and used to inspect non-standard TLS traffic transmitted over a proxy.

After hardening non-RFC-compliant HTTP requests, some Mobile VPN connections fail. Since multiple clients send bare LF requests (a specific type of non-RFC-compliant traffic), bare LF errors are now disabled by default. This behavior can be enabled using the kernel parameter "ws_block_bare_lf".

Policy installation may fail on a Cluster Member in this scenario:

1. In the legacy file $FWDIR/conf/cpha_specific_vlan_data.conf, an interface was added without a VLAN ID.

2. The value of the kernel parameter "fwha_monitor_specific_vlan" is "0".

After rebooting the Security Gateway, the Allow List entry is present when viewing the list, but it is not enforced. The Deny List takes precedence, and traffic from the IP is blocked, even though it should be allowed according to the configuration.

In some scenarios, the VSX Security Gateway passes traffic without performing proper NAT from a Virtual Router or Switch's external interface when SecureXL User Mode is enabled.

In some scenarios, an error occurs in UPPAK mode when packets are cloned. This can lead to random crashes in the USIM process, causing instability during interface changes or high traffic.

In some scenarios, DOS/Rate Limiting causes blocking errors during boot.

In some scenarios in UPPAK mode, the nexthops may be incorrectly indexed, which leads to packet drops.

Error messages are generated when running the "fwaccel dos statistics get" command, cluttering the usim_x86.elg log file.

The ROUTED daemon may exit when running the "show bgp paths" command.

On VSNext Clusters, during startup, the ROUTED daemon does not install cluster Virtual IPs (VIPs) on certain non-VS0 Virtual System (VS) routing instances. As a result, Dynamic Routing protocols (such as OSPF, BGP) fail to operate correctly on the affected instances.

After deleting several Virtual Systems, stale wrpj interfaces remain attached to Virtual Switches. SmartConsole shows these orphaned interfaces with error text "Virtual System with the ID X does not exist".

In some scenarios, on VSNext environments, Backup and Restore fails to restore a backup, causing all Virtual Systems to be in a DOWN state.

Connecting a Virtual Gateway to a Virtual Switch with a long name in Gaia API may fail.

When using VSX SmartProvisioning on Maestro, the operation fails if the VSX Gateway name includes the substring "wrp0".

Added new SNMP OIDs to enable monitoring of physical resources per Virtual System (VS) via VS0.

After a clean installation using CPUSE, interfaces configured with IPv6 are in an "off" state.

CPU spikes may occur in a cluster when SNMP is enabled.

Clish may restart unexpectedly when running the set snapshot-onetime command.

In rare scenarios, the CORE_UPLOADER process on Security Gateways may unexpectedly generate a core dump when the number of detected CPU cores exceeds a specific threshold.

Excessive log entries for RADIUS users logging into Gaia Portal. Refer to sk184534.

Unable to enter Virtual System with "virtual-system-access all" configured. Refer to sk184282.

In Gaia Portal, for VSNext, the Bridge Group field displays the validation error "The minimum value for this field is 1001," but does not enforce it, and it is possible to submit and create bridge object IDs with values below the minimum threshold. The fix adds validation for the bridge ID during bridge creation in VSNext.

After disabling Two-factor authentication (2FA) in Gaia OS, the user still requires a 2FA code on login attempts.

For IDNS-Resolver, when the DNS server returns "TC=1", and communication should be moved to TCP instead of UDP, TCP communication does not block DNS requests.

When using Capsule VPN or Endpoint Security VPN (Connect) clients in IPsec mode with IKED enabled, users can successfully authenticate and establish a VPN tunnel. However, group information received from the RADIUS server is not passed to the IKED process. As a result, security policies and access roles that rely on RADIUS group membership do not apply, and users are unable to access internal resources through the VPN

Traffic passing through a route-based VPN tunnel may cause high CPU usage if the traffic is fragmented.

Improved SSL Network Extender (SNX) certificate-based authentication stability and session reliability.

When Hub Mode is not enabled, traffic destined for dynamic objects included in the Remote Access VPN Split Tunneling Inclusion group may be incorrectly dropped. As a result, remote users may be unable to access resources defined by these dynamic objects, even though they are specified for inclusion in the split tunnel.

Improved input validation in the VPN L2TP PPP packet parser to handle malformed configuration options correctly.

When IKEv2 is configured in a Remote Access community, Remote Access clients are incorrectly classified as DAIP (Dynamic Address IP) gateways during IKEv2 negotiation. This causes authentication with machine certificates to fail, preventing successful VPN client connections.

Remote Access IKEv2 VPN authorization may fail for LDAP Active Directory users whose Common Name (CN) in their certificate is email-based (for example, user@domain.com). When such users authenticate using an External User Certificate, they are unable to pass traffic to the Encryption Domain, resulting in dropped connections.

Certificate validity period not applied after using the "set_cert_validity" command. Refer to sk184230.

SD-WAN overlay traffic debugging is improved, enhancing visibility and troubleshooting capabilities.

A VPN IPv6 traffic outage may occur when a host/network object is defined with the Security Gateway's main IPv6 address.

In a rare scenario, the FWK process may crash when handing SD-WAN traffic.

In some scenarios, SD-WAN ISP link status may fluctuate between UP and DOWN states. Reduced SD-WAN ARP probing default sensitivity to packet drops.

Moving Cloud licenses from one pool to another triggers license alignment: If adding a new license to CK fails, license removal will not be initiated on the Security Gateways.

When deleting a bond in an ElasticXL environment, site failover may occur.

Intermittent VS failover when both Maestro Hyperscale Orchestrators (MHOs) have the interface link state set to Down. Refer to sk184568.

In a dual-site Security Group configuration, if all members of site 1 are removed from the Security Group, the Hardware tab in SmartConsole displays an error message instead of the expected hardware information.

• When a large number of bond interfaces are configured, the synchronization of link states may fail.

• In rare scenarios, a cluster member may become stuck in the "active (sync)" state. When this occurs, the affected member does not handle network traffic as expected.

• There may be inconsistencies in the reported link state across Security Group Members (SGMs), as observed with the "asg stat -v" command.

 A remote user may not be able to switch between Virtual Systems (VSs) in the WebUI. While a local admin user is able to switch between VSs as expected.

After a Virtual System (VS) is deleted, its CTX folders are not removed.

In some scenarios, the "asg monitor" freeze timer is missing for ElasticXL clusters.

In VSLS clusters with multiple members, when a member rejoins the cluster after a reboot, an Interface Active Check (IAC) problem notification may incorrectly appear on the rejoining member, showing it in ACTIVE state. This occurs even though all interfaces are physically UP and the cluster is fully functional.

Policy installation on one Virtual System (VS) fails without a visible error message. Refer to sk184194.

All traps coming from a dedicated Member of a Security Group now include the hostname.

For example, a trap for Member 1_4 will include the hostname (for example, hostname-s01-04), providing clearer identification than just 1_4.

On ElasticXL, changing the freeze interval by running the command "set cluster configuration high-availability freeze_interval 30" is not applied to Virtual Systems other than VS0.

Added the ability for alerts to send traps to trap receiver servers using IPv6.

When performing a SIC reset after Anti-Malware (AMW) has been installed, some members may enter a "cluster-down" state with an AMW Critical Device.

Upgrade of a Scalable Group in the Traditional VSX / VSNext mode fails.

• The Jumbo Hotfix Accumulator package must be installed on both the Management Server and the Scalable Group.

In some scenarios, a Gateway that leaves the cluster is still shown as an active member to other Security Group members. This can result in the Gateway not being displayed as an available Gateway.

The HCP configuration sync verifier ("config_verify") incorrectly reports a failure because the asg_diag_file.dat file is not synced between members.

In a rare scenario, a processed malformed GTP packet may cause the Security Gateway to crash.