[Action Required] – Important notification to Customer with Threat Emulation blade enabled – An Upda

RemoteUser — Wed, 06 May 2026 18:23:28 GMT

Dear valued customer,

Following an internal review using newly available AI tools, we have proactively identified a potential risk in your environment related to Threat Emulation.

We have already prepared a solution for you - it is imperative that you install it at the soonest possible time.

Implementing the solution is a straightforward process that does not require a reboot, restart, or policy install.

Be advised that this notification is relevant for customers using Threat Emulation with Gaia versions 80.40, 81, 81.10, 81.20,82, 82.10

Proposed Solution- Please follow one of the two options below:

Option 1 - Enable Automatic Updates (Recommended):

Note: The Security Gateway / Threat Emulation appliance must have an active Internet connection.
Automatic downloads are enabled by default. If they were previously disabled, you must re-enable them using the following steps:
1. Enable the required consent flags:
For Gaia versions R81.20 and higher - You must enable the 'Download Security' consent flag. Refer to sk175504 (See section: 2. Enabling and Disabling the Consent Flags).
For Gaia versions R81.10 and lower: You must enable the 'Allow Download' consent flag. Refer to sk111080 (See section: 4. How consent flags are modified)

2. Enable Automatic Updates for Threat Emulation:
Follow the official Administration Guide for your specific Gaia version to enable automatic updates for the Threat Emulation blade:
(Go to 'To enable or disable Automatic Updates for Threat Emulation')
R82.10: Threat Prevention Admin Guide (R82.10)
R82: Threat Prevention Admin Guide (R82)
R81.20: Threat Prevention Admin Guide (R81.20)
R81.10: Threat Prevention Admin Guide (R81.10)
R81: Threat Prevention Admin Guide (R81)
R80.40: Threat Prevention Admin Guide (R80.40)

Option 2 - Perform an Offline Update:

If your Security Gateway/ Threat Emulation appliance operates in an offline environment or cannot connect to the Internet, you must manually apply the update.
1. Follow the procedure to import and install an offline Threat Emulation update package as described in sk92509.
2. Ensure you download and install engine revision 11.36 Revision 60.990002500 or higher.

Verification:
After completing either Option 1 or Option 2, verify that the update was successful.
1. Connect to the command line on your Security Gateway.
2. Log in to Expert mode.
3. Run the following command to check the current engine version: tecli advanced engine version
4. Confirm that the output displays version 60.990002500 or higher.

For any further questions, please contact our Technical Support or email us at contact_support@checkpoint.com.

Check Point is committed to delivering the highest quality products and services. Thank you for driving this with urgency.

Sincerely,

Re: [Action Required] – Important notification to Customer with Threat Emulation blade enabled – An

sascham — Thu, 07 May 2026 10:55:11 GMT

Hello, and apologies for what might be a silly question: I’m not entirely sure whether this also affects the use of ThreadCloud. We don’t use local analysis. The Emulation Engine version on the gateway is 59.x.

Thanks in advance.

Kind regards

topic [Action Required] – Important notification to Customer with Threat Emulation blade enabled – An Upda in Firewall and Security Management

[Action Required] – Important notification to Customer with Threat Emulation blade enabled – An Upda

Re: [Action Required] – Important notification to Customer with Threat Emulation blade enabled – An