EN: Understanding Harmony Endpoint Versioning: E-Releases, Recommended vs Latest & Support Windows

jorgeluiznim — Wed, 02 Sep 2026 20:02:41 GMT

Article 8 of the Harmony Endpoint Deep Dives series · A note on management: Harmony Endpoint is cloud-managed (Infinity Portal / Web Management) in most deployments today. The client versioning model below is the same either way; the one difference is the server/management family, which only applies on-premises — in the cloud, Check Point runs the management service and keeps it current for you.

Purpose

E88.62, E88.70, E88.72, E89.00 — what do these numbers actually mean, which one should you run, and for how long is it supported? This article decodes the Harmony Endpoint client versioning model: the E-release anatomy, the Release Map, the Recommended-version concept, and the official support lifecycle — so version planning stops being guesswork.

Audience

[x] Endpoint Administrators
[x] Security Engineers
[x] Beginners
[ ] SOC Analysts
[ ] Experts

Prerequisites

None — this is a foundation article. Pairs naturally with Agent Upgrade Best Practices (Article 5)

Two Version Families, One Environment

Harmony Endpoint environments carry two independent version schemes:

Family	Format	Examples	What it versions
Server / Management	`R<major>.<minor>`	R81.20	Endpoint Security Management Server (on-premises only)
Client	`E<major>.<minor>`	E88.72, E89.00	The Endpoint Security client on Windows/macOS/Linux

They evolve separately. On-premises, one rule binds them: clients must connect to a Management Server of a higher version for management and upgrades (see Article 5). In the cloud, the management service is run by Check Point and always current, so this article is really about the client (E) family — that is the version you plan around. Also useful for history: clients earlier than E80 are considered legacy clients in the Administration Guide.

Anatomy of an E-Release

E88.72
│ │  └── minor level — often a hotfix of the previous minor
│ └───── major client line (has its own Release Notes + Release Map)
└─────── "E" = Endpoint client release

A real example straight from the official SK titles: sk183380 — "Enterprise Endpoint Security E88.72 (E88.70 Hotfix) Windows Clients" — E88.72 is explicitly a hotfix release complementing E88.70.

Every release ships with:

A dedicated SK article (download packages, new features, resolved issues, known limitations)
An entry in the line's Release Map (with GA date and support status)
Usually a CheckMates announcement post ("...is now available" / "...is our Recommended version")

The Release Map: Your Single Source of Truth

Each client line has an official Release Map page. A snapshot of the E88.x map (accessed 2026-07-16):

Version	GA date	Status	SK
E88.72	26 May 2025	Supported	sk183380
E88.70	09 Mar 2025	Supported	sk182578
E88.62	10 Feb 2025	Supported	sk182996
E88.61 → E88.00	Dec 2024 ← Jan 2024	Unsupported	—

The pattern that matters: only the few most recent versions of a line remain supported — everything older is marked Unsupported. If your fleet runs E88.20 "because it works", you are running an unsupported client.

Recommended vs Latest

Check Point designates a Recommended version (announced on CheckMates, e.g. "E88.72 for Windows is our Recommended version") — the version with the widest field validation. The Latest GA (e.g., E89.00 when it shipped) brings the newest features and improvements first. The terminology itself is defined in sk95746 — Check Point Recommended Version and Release Terminology.

✅ Best Practice: run the Recommended version on the production fleet; evaluate the Latest GA in your pilot ring (see the gradual rollout model in Article 5).

ℹ️ Cloud note: cloud tenants can hand the "stay current" job to Automatic Client Update (Windows, cloud-only), which upgrades clients to the latest version silently. Keep it on for steady-state, and still use a pilot ring for the Latest GA before it reaches everyone. See Article 5.

The Official Support Lifecycle

From Check Point's public Support Life Cycle Policy (for Endpoint Security and Remote Access, as of June 1, 2022):

Every software product is supported for at least 18 months from its GA date
Once a year, one version is designated for extended support of 30 months from GA

Practical consequence: if you want the longest runway between mandatory upgrades, target the yearly extended-support version; if you upgrade twice a year anyway, any Recommended version works.

Where to Check (bookmark these)

Resource	What you get
Release Map (per client line, e.g. E88.x)	GA dates + support status per version
Release Notes (per line)	Supported OS/features per version
sk117536 — Endpoint Security Homepage	The hub SK linking all client releases
sk95746 — Recommended Version and Release Terminology	Official definitions (GA, Recommended, etc.)
CheckMates Endpoint board	Release and Recommended-version announcements

Version Strategy in Practice

Inventory — the Asset Management view (Computers) shows the client version installed on each device (e.g., 86.25.5060), so you can see what your fleet actually runs
Check the Release Map — anything in the Unsupported rows goes to the top of the upgrade backlog
Choose the target — Recommended for production; Latest GA for the pilot ring; the extended-support version if you need a long runway
Roll out — Automatic Client Update for steady-state, or Deployment Rules + Dynamic Packages + gradual rings for change-controlled windows (Article 5)
Repeat — the Release Map changes several times a year; make checking it a monthly habit

Common Mistakes

Mistake	Impact	Solution
"It works, don't touch it" on an old minor	Fleet silently drops out of support	Monthly Release Map check; upgrade backlog
Chasing Latest GA fleet-wide on day one	Newest code with least field time on all endpoints	Latest in the pilot ring; Recommended in production
Assuming server and client versions move together	Upgrade planning errors	They are independent families; only the "server ≥ client" rule links them
Reading version status from memory or old forum posts	Stale decisions	The Release Map and the release SK are the source of truth

FAQ

Q: What does the "E" mean? A: It denotes the Endpoint client release family (e.g., E88.72), as opposed to the R-numbered server/management releases (e.g., R81.20).

Q: Is a higher minor always a feature release? A: Not necessarily — minors are often hotfixes. E88.72 is officially titled "E88.72 (E88.70 Hotfix)".

Q: How long is a client version supported? A: At least 18 months from GA, and once a year one version gets 30 months of extended support (official Support Life Cycle Policy). In practice, also watch the Release Map — older minors within a line get marked Unsupported as newer ones ship.

Q: Where do I see the current Recommended version? A: CheckMates announcements and the release SKs; the terminology is defined in sk95746.

Q: What counts as a "legacy" client? A: Versions earlier than E80 (per the R81.20 Administration Guide) — those have special upgrade procedures (see Article 5).

Agent Upgrade Best Practices — Article 5 (how to get from version A to B safely)
Harmony Endpoint Architecture Overview — Article 1 · Read on CheckMates ↗

References

E88.x Release Map (official) (accessed 2026-07-16)
Endpoint Security Clients for Windows E88.x Release Notes (PDF)
Check Point Support Life Cycle Policy (accessed 2026-07-16)
sk95746 — Check Point Recommended Version and Release Terminology (content verified 2026-07-16, public; SK last modified 2026-04-13. It is the canonical release-terminology reference — its examples use the R-release line, e.g. "Check Point Recommended version for all deployments is R82 with its Recommended Jumbo Hotfix Accumulator Take"; the E-release client model follows the same GA/Recommended terminology.)
sk117536 — Endpoint Security Homepage (login required)
sk183380 — Enterprise Endpoint Security E88.72 (E88.70 Hotfix) Windows Clients (login required)

Revision History

Date	Version	Author	Changes
2026-07-16	1.0	Jorge Luiz	Initial version
2026-07-30	2.0	Jorge Luiz	Cloud-first revalidation: clarified that the server/management (R) family is on-premises-only and the cloud service is Check Point-managed; inventory via the Asset Management view; Automatic Client Update as the cloud way to stay current; kept the evergreen Release Map / lifecycle guidance

Supported Versions: evergreen reference (cloud-managed and on-premises); examples reflect the E88.x line as of 2026-07-16 Last Updated: 2026-07-30

topic EN: Understanding Harmony Endpoint Versioning: E-Releases, Recommended vs Latest & Support Windows in Endpoint