R82 Jumbo Hotfix Take 126

NEW: Introducing the show-ad-content Management API, which enables the retrieval of users, groups, and machines from Active Directory.

NEW: Added support for integrating clean-install machines running a higher version into an existing ElasticXL environment.

UPDATE: New features and improvements are released in Take 177 and Take 178 of Web SmartConsole. Refer to sk170314.

UPDATE: Added Take 97 of Policy Insights Release Updates. Refer to sk183421.

UPDATE: Added Take 325 of CME (Cloud Management Extension) Release Updates. Refer to sk157492.

UPDATE: The HCP configuration sync verifier (the config_verify command) may incorrectly indicate a mismatch in the fwkern.conf file due to differences in the line order between members.

UPDATE: Added support for the match-settings parameters in the application-site Management API.

UPDATE: Gaia Cloning Group synchronization (port 1129) now uses updated and more secure SSL/TLS versions for internal communication. Refer to sk182091.

UPDATE: Added support for treating trusted CA certificates with non-compliant attributes as valid. This includes certificates with incorrect Key Usage settings or missing Basic Constraints, based on customer-defined configurations. Refer to sk183800.

UPDATE: Resolved CVE-2026-85103 - ASN.1 decoding heap overflow leading to a remote code execution. Refer to sk1000118.

Accelerated policy installation may be skipped if Compliance generates a high number of audit log entries between sessions.

After deleting a Security Management Server object, attempting to create a new management host object with the same IP address may fail with an "IPv4 address is already in use" validation error.

In some scenarios, running the show access-rulebase Management API command with a non-existent object identifier could return an HTTP 500 error with a "Null Pointer Exception" error message.

Policy objects may fail to open in Web SmartConsole with a "Something went wrong" error message.

Administrators logging into SmartConsole with certificate authentication at the MDS level using the "\MDS" format may unexpectedly receive read-only permissions instead of the expected read-write access.

Snort IPS protections are not downloaded to the local domain during Global Policy Assignment.

In some scenarios, the Integration & Services view in Multi-Domain Security Management Servers may show the following error message even though the Allow Upload setting is enabled: "An error occurred on the server "<server_name>": The consent option "Allow Upload" is disabled. Refer to sk176064."

Improved debug logging in the cpm.elg file during upgrades of a Multi-Domain Security Management Server.

In SmartConsole, a network object that is no longer referenced by any policy may fail to be deleted with an "object is being used" error message.

In a Management High Availability environment, the statuses of clusters and cluster members may be displayed incorrectly on the secondary Security Management Server.

In some scenarios, when a Multi-Domain Security Management Server is connected to the Check Point Portal, a connectivity failure warning for the Global SmartEvent server may appear, even though Global SmartEvent servers are not supported in the Check Point Portal.

In some scenarios, logging into SmartConsole may fail or time out.

Security Gateways created using the Management API or SmartConsole might be assigned duplicate Dynamically Assigned IP (DAIP) addresses. Refer to sk185077.

Policy installation may fail when custom authentication .ttm files are not included during policy package preparation, resulting in a "No such file or directory" error message.

On a Multi-Domain Security Management Server, the "api stats-group-by-domain" command may report all requests as "unknown domain" instead of categorizing them per domain. Refer to sk183892.

Changes made to .def and .conf files are not applied during an accelerated policy installation if a previous policy installation failed after the files were updated.

When logging in to SmartUpdate on a Multi-Domain Security Management Server, domain licenses may not appear in the Domain Licenses view.

When running the LSMcli AddROBO command with the -S (SubstitutedNamePart) parameter, the cluster profile name suffix may not be substituted correctly.

When viewing Forensics Reports in SmartView through the Check Point Portal, non-ASCII characters may appear distorted.

In some scenarios, the Service field may not appear in logs for certain connections, primarily for dropped traffic, even when destination port information is available in the raw log.

In some scenarios, the LOG_INDEXER process may unexpectedly exit and generate a core dump while processing log files.

Exporting logs that contain "ampersent" in their fields to a CSV file via SmartView web application may fail with a “Failed to export” error message.

When a user configures NAT to convert a connection's destination IP address from unicast to multicast, the Security Gateway may transmit packets with an incorrect MAC address when SecureXL is enabled.

The FWK process may restart unexpectedly due to improper handling of a connection.

The PDPD daemon may encounter high CPU utilization when Nested Groups query method 5 (query by SIDs) is in use. Refer to sk183748.

In some scenarios, Spike Detective file descriptors may remain undeleted.

The custom trap for BGP may not work on MDPS when BGP is configured in the Data Plane. Refer to sk183633.

The FWK process may unexpectedly restart because of an incorrect integration with CPView.

Enhanced stability when manual edits to the fwkern.conf file result in a malformed configuration. To manage the file, it is recommended to use the -f option of the fw ctl set command, as detailed in sk26202. Refer to sk184081.

In some scenarios, a memory leak in the FWK process occurs when two HTTP/2 upgrade requests are sent over the same connection.

In some scenarios, incorrect memory size allocation identified in the c_icap open-source code may cause a crash in the ICAP Server.

Threat Prevention inspection of Server Message Block (SMB) traffic during CREATE+WRITE operations may cause a memory leak during file write processes.

In some cases, an ICAP server closing the connection to an ICAP client with an RST may cause an FWK process crash.

When using ISP Redundancy in a VSNext environment, failover between ISPs may not occur if the WRP interface is configured as one of the ISPs.

In certain scenarios, the Security Gateway may fail to apply a new GeoIP database update.

Files without extensions were receiving a Scan Pass verdict from the ICAP server. As a result, malicious files without extensions were also assigned a Scan Pass verdict, which ultimately led to a Benign classification.

Improved handling of duplicate Identity Collector events on the PDP Security Gateway.

In some scenarios, errors in rule number calculation prevented packet tagging from working.

Enforced compliance with the HTTP RFC by requiring a "/" in the request path for non-proxy HTTP connections, except for the CONNECT and OPTIONS methods. Traffic that does not meet this requirement will be dropped if "Non-Compliant HTTP" is set to "Drop" and "Strict Request Parsing" is enabled.

In some scenarios, a memory leak may occur in the WSTLSD process when it fails to decode a certificate.

When processing VPN traffic in a ClusterXL environment with "sync-to-all" enabled, the absence of sequence number updates from the active site can cause the Fast Acceleration (FnA) mechanism to become unresponsive. As a result, affected connections may be dropped, and a log entry is generated "dropped by fw_conn_inspect Reason: Frozen connection".

In scenarios involving asymmetric traffic, where the same connection tuple is reused frequently, connections may be dropped and flagged as "out of state". Refer to sk184181.

Multicast routes may not update or respond correctly to changes in the network.

In rare scenarios, a performance issue may occur when a policy is installed on multiple Virtual Systems simultaneously. Refer to sk184585.

In some scenarios, the Security Gateway may not properly remove closed TCP connections, processed through Active Streaming, from its accelerated connections table if a new security policy was installed beforehand.

A rare scenario handling Jumbo Frames of specific sizes on Intel-based NICs may trigger a driver internal protection (MDD) error, potentially impacting performance or connectivity.

In certain scenarios, the VSX Gateway may transmit packets with incorrect MAC addresses for cleartext connections when SecureXL is enabled, specifically when these packets are sent through a Virtual Router or Virtual Switch.

In some scenarios, the VSX Gateway may not properly assign CPUs to a Firewall instance or SND after booting up when SecureXL User Mode is enabled.

In rare scenarios, the Security Gateway may unexpectedly crash due to timer corruption.

When syslog messages are forwarded to the Security Management Server using the set syslog cplogs on command, they may be misclassified under an incorrect blade instead of Syslog. This misclassification can make it challenging to filter, correlate, and analyze the logs effectively.

The lower bottom threshold for the PCH-Vin sensor on Check Point Firewall 9700 appliances was set incorrectly.

After backup and restore, Gaia Portal enforces 2FA, but Clish allows password-only login and does not prompt fora 2FA code. Refer to sk184285.

Performance improvements have been made to the VSX interface configuration process.

Upgrading a Scalable Group in Traditional VSX or VSNext mode may fail if the Jumbo Hotfix Accumulator package is not installed on both the Security Management Server and the Scalable Group.

In some scenarios, the Security Gateway may fail to access interface data correctly when SecureXL User Mode is enabled.

In a rare scenario, the CPU time may be displayed incorrectly.

When the backup file size is large, export to Microsoft Azure may fail. Refer to sk184010.

Certain standard IPv6 addresses may have been incorrectly identified as multicast addresses.

When receiving an equal-cost LSA from two different ASBRs, only one next hop was previously installed for the route. Now, all relevant next hops are installed.

VLAN filtering was incorrectly enabled on VSNext bridges, causing traffic to be tagged with VLAN 1 or dropped.

In Maestro in VSNext mode, using a Virtual Switch with a data interface as the management interface may cause traffic flapping due to incorrect MAC address assignments between the members.

The Mobile Access Blade portal may not function properly with web applications that set HTTP cookies containing the pipe ('|') character in their values.

Automatic Security Gateway certificate enrollment using CMP with an external OPSEC PKI CA (for example, EJBCA) fails with "Internal Error" status in SmartConsole.

In some scenarios with DAIP peers, VPN tunnel tests may fail, causing intermittent disruptions.

In rare scenarios, the VPND process may crash during Capsule VPN connections that use Mobile Device Management (MDM) compliance and certificate-based authentication.

Capsule Connect / VPN users are unable to log in and receive the error message "Client's configuration is not verified". Refer to sk185144.

Improved IKEv2 stability when handling concurrent IKE messages that share the same IKE cookies.

Improved stability in VPN tunnel monitoring workflows.

Improved stability and robustness in VPN session message handling during connection flows.

Enhanced stability and reliability in IKEv2 certificate handling.

In a Traditional VSX deployment, the SD-WAN steering process may generate core dumps, even if SD-WAN is not configured on the machine.

Nightly distribution may fail when no default license pool is set. The system now automatically promotes an available pool during distribution.

In some scenarios, a member may become stuck in the INIT state after being rebooted during a sync loss between sites.

In rare scenarios, a full sync may fail to occur after a reboot because the sync is triggered before the full sync request is completely registered.

On a Maestro Orchestrator (MHO), the FWD process may unexpectedly start during cpstart, displaying "FireWall-1: This is a Security Management server, No security policy will be loaded" messages on the console.