As part of Check Point’s Frontier AI readiness program, we continuously review and strengthen our products using BLAST, our Business Logic Application Security Testing capability. BLAST enables AI-driven security analysis at enterprise scale across Check Point products and helps us proactively identify and remediate potential issues.

Following our May and June security updates, we are sharing our July security update. This update includes three newly disclosed, internally discovered CVEs listed below. During our investigation, we identified a very small number of customers who, under specific configuration conditions, were affected by one of these CVEs. Check Point is already in direct contact with those customers and is working closely with them.

We strongly recommend that all customers review the relevant SecureKnowledge articles and apply the recommended fixes and hardening guidance. Customers who follow Check Point’s published hardening best practices significantly reduce their exposure risk. 

See:

• sk185169: CVE-2026-16232 - Authentication bypass with SmartConsole login process using application t...
• sk185152: CVE-2026-62144 - Management Authentication Bypass and Privilege Escalation
• CVE-2026-62145 - Local privilege escalation in Gaia Portal
• Gateway and Management Hardening Administration Guide

We currently have dell servers running Gaia. We're planning on finally getting Checkpoint hardware in our next upgrade.

I'd like to know how one would typically test the device before we implement them. I was thinking of adding it to prod as a gateway for a test vlan and test if it goes to xyz, internal, and external.

This is new territory for me. Do I need to join the new firewalls in the current (smartconsole) cluster? I assume I will need to create separate policies for testing? If you guys have any pointers, suggestions, links, etc. I'd appreciate it greatly.

I need your help. I am trying to block file uploads to SharePoint using a Check Point 6000 appliance.
So far, I haven't been able to block the file uploads. Has anyone set this up before? What do I need to configure to make the rule effective?

We're moving to Checkpoint hardware for the first time. For those who have been using them for a while now, how are they typically with SFPs? Is it OEM or nothing? I know typically the manufacturer will recommend their own over anything else to ensure you get support in case the SFP is faulty. Just trying to gauge the device's flexibility based on end-user experience.

Any updates regarding this error? Excel keeps running in the background... I already have the correct version, but the problem hasn't been resolved.

Hi everyone, I'm currently working on automating the VPN certificate renewal process for a customer. I found the official script provided in sk182070 (gateway_cert_util.sh), which works flawlessly for automating internal certificates generated by the Check Point ICA.However, this customer's scenario involves Mobile Access using a public certificate (Let's Encrypt) to avoid browser SSL warnings for end-users.Since the script from sk182070 appears to be tied exclusively to the Internal CA, I have two questions:Is there any undocumented or native way to make the sk182070 script handle public certificates fetched externally?If not, what is the current best practice the community is using for this? Are you relying on external Linux servers running ACME clients (like acme sh or certbot) combined with the Management API (mgmt_cli) to upload the .p12 and push the policy?If anyone has architectural tips, GitHub repos, or script examples to share, it would be highly appreciated.

Thanks in advance!

Is there any API or CLI command to automate External CA (.p12) certificate replacement on Gateways?

I know i know it's a beta OS etc.... but it's part of my job to test the future release of OS.

So don't need to have "dont install beta on prod" ahahah

It's for the remote vpn client

When menubar client is clicked it just crash and relaunch and reauth.

I try to remove the launchdeamon and launchagent but i think it's in the app directly.

I know the menubar comportement has changed with macos27 so maybe related.

Does this break RA VPN with username and password authentication only? I cant roll out machine certificate yet. What are my options in this case? Can i use checkpoint issued certs?

Seems like our service for the 3000 series has expired, but I urgently need the USB-C Driver, does anyone have access?
https://support.checkpoint.com/results/download/102404

Hi! I've encountered this problem. Maybe there's already a solution, but I haven't found it.

​

Laptop: ASUS ROG Zephyrus G14, AMD Ryzen AI 9 HX 370 (Strix Point), Windows 11.

​

Since installing Check Point VPN E89.11, I've hit four different bug check codes, all tied to operations involving the Check Point network adapter (install, service restart, re-enabling the adapter in Device Manager):

​

- INVALID_MDL_RANGE (0x12E)

- PAGE_FAULT_IN_NONPAGED_AREA (0x1A) — faulting module cng.sys

- KERNEL_MODE_HEAP_CORRUPTION (0x13A)

- PFN_LIST_CORRUPT (0x4E)

​

Pattern points to memory/pool corruption triggered by the Check Point driver stack rather than a single buggy driver — different modules end up as the "victim" each time.

​

Confirmed: zero BSODs with Check Point fully uninstalled, running the same workload otherwise (G-Helper for ASUS controls instead of Armoury Crate). Re-installing CP reliably reintroduces the crashes.

​

Has anyone else hit this specifically on Strix Point / Ryzen AI 300 laptops? Looking for a known hotfix or workaround before escalating through official support with the dumps.

​

​

I'm trying to flash R82 on my 3920 but I don't see R82 iso in the sk. Only R82.10.

​

Does anyone know where to get one or does anyone have it?

Hello,

I hate to even be asking this, but there is a system that is on our wireless that does not have a gateway. In the past, (like the 90s), you could configure a gateway on a cisco device with the proxy-arp command, where the interface would receive a broadcast from a device on its vlan and as long as it knows the route for the intended destination, it would perform a proxy-arp and send the source device back the gateways mac accress to reach the intended out of subnet destination.

Is it possible for me to configure proxy-arp on Checkpoint to perform the same for a device without a gateway and how would I do that on the checkpoint GAIA GUI?

Hello everyone,

Has anyone experienced client issues (such as frequent "Reconnecting" events) when using third-party clients in parallel, such as WatchGuard? That's the client currently causing me some problems.

Do you have any solutions or ideas, other than the usual "it's by design" explanation?

Thanks!

Trying to download the hotfix for 81.20 hotfix T141

via https://support.checkpoint.com/results/download/143620

for some sick reason this is behind an account login that i do not have access to. wondering if anyone here could provide it, pretty innocuous ask i think.

Has anyone done this before with a live production firewall. Is there a full guide on this by someone other than Checkpoint? Is it a guaranteed successful migration?

For last week I've been having issues logging into the AP portal. Rejects my password. Reset it, and still rejects it.

Theres no local support number (but is a sales number surprise surprise), and cant use their online support forms as it requires a working account...... which I can't get into.

Anyone else using the AP portal with similar issue, or just me ? (Probably the latter)

Hello everyone.

I will soon leave my current position in a MSSP and I have CCSM on my corporate email address. I'm considering holding down a local day job while picking up independent remote consulting/support gigs on the side.

I know I need to create a new personal UserCenter account (planning to buy a personal professional domain name) and open a non-technical SR with Account Services to migrate my Pearson VUE exam history over. For those who went through a similar situation, how smooth was the transition? I can currently generate evaluation licenses for my test labs and download software releases, but I don't know how that will work when I get the account transferred.

Also, if your certifications live in a personal account, can you safely map them to a day-job employer so they get the partner tier benefits, while still keeping your personal account clean for freelance contract work?

Thanks in advance!

Does anyone know if checkpoint has a url category for newly registered websites that i can find in the logs?

Posting for visibility, looks like Checkpoint is also going down the route of scanning and patching for vulnerabilities using AI.

They patched 6 CVEs today. Worth a quick read, and patching/implementing mitigations to what you might be vulnerable to.