Harmony EndPoint Security Client: Failed to update Anti-Malware Database

[ccsjnw]

We have the Harmony EndPoint Security Client deployed on all Windows desktops, laptops, servers & Domain Controllers.

Version E82.72.2026 is deployed everywhere, except on our Domain Controllers, which have version E89.05 installed.

We are seeing a universal failure (all machines affected) when the clients attempt to update the Anti-Malware Database:

Failed to update Anti-Malware Database

At first, I thought this was a symptom of the recent Time problem (due to the wrong interpretation of 2026 being a leap year).
However, the Firewall Manager and all all Security Gateways have now had the Time Fix deployed, and the problem persists.

Machines that are outside of the organisation (not behind the organisation's Security Gateways) are also impacted, and cannot obtain their Anti-Malware updates. We are using Cloud management for our Harmony EndPoint Security implementation.

I'm starting to think that the EndPoint Clients also have their own version of the Time bug...

I can't find any recent SK articles on the the topic.

Is anyone else currently experiencing these failures?

I don't see any update errors in the logs... 

However, DNS results for updates.checkpoint.com seem strange:

(The anti-malware signatures are updating correctly on our Security Gateways - it's just the Harmony Security Client that is affected).

If this is currently working normally for you, I'd also be interested to know that too...
(please post what version you have deployed).


Thanks!


@PhoneBoy can this be escalated please? This feels very much like a widespread outage affecting many Check Point customers.

[Simon_Moscovitz]

same here.. E89.10

[ccsjnw]

That's interesting... I'm hearing from other organisations (that I have no connection with) that they are impacted too, but Check Point are silent...

Problem is currently occurring in the UK and Gulf states (Middle East).

[fat2]

happening for my endpoints.  I'm in US

[fat2]

same here, 89.10 clients

[Paul_Stephenson]

Same here, mostly 88.72 with a few 89.10 for testing.

89.10 seems to instantly fails the update check whereas 88.72 thinks for a bit before saying its failed.

These are internal behind Check Point firewalls, have not been checked in the wild. UK based.

[lluner]

. Problem in the XML file. It would be interesting to open a TAC (Technical Assistance Center).

I don't know if it's related to that. https://status.checkpoint.com/

[ccsjnw]

I know of a British IT consultancy company that has opened a support case.

[PhoneBoy]

If anyone is willing to test this on one of the affected endpoints, try setting the date one day ahead to see if the problem resolves.
That would indicate this issue is the likely reason: https://community.checkpoint.com/t5/Firewall-and-Security-Management/Certificate-and-CRL-validation-...

In any case, I found at least one TAC case related to this issue.
I suggest others experiencing this issue do the same.

[fat2 · Accepted solution]

I opened a case, I guess they didn't realize it was an issue.....

SR#6-0004547678 failed to update anti-malware database

Hello Frank,

Thank you for your response.

This may be an internal issue as my own client is doing the same and a couple other of my team. our Dev team is investigating this issue. I will update once I have more information.

[ccsjnw]

Thanks for getting this expedited and fixed 🙏

[lluner]

@ccsjnw 

They solved the problem.

[ccsjnw]

Yes - working for me this morning 😀

Glad the fix was handled by Check Point remotely, and didn't need any manual intervention.

However, I find it concerning that that nobody within Check Point noticed this was broken until it was flagged up here.
There's definitely room for improvement in quality control & routine testing ...