Check Point R81.20 HF-170 Caused Remote Access User Outage when SMS was HF Updated

[D_Riddleberger]

I have an environment SMS R81.20 HF-141 and multiple clusters R81.20 HF-141 and after the SMS was HF updated to HF-170 and policy was installed to gateways, all RA Users were unable to connect. The symptom was each RA User lost the ability to select Authentication methods in their VPN Client. Additionally, the gateway would not respond if a 'New Site' was attempted to be created. A TAC case has been opened but TAC is unable to re-create the issue.

Next question would be, has anyone else updated their R81.20 SMS to HF-170 and the environment supports RA Users??

[CheckPointerXL]

Mhhh did u lost some custom file on mgmt side? Trac client? Are user authenticated against mgmt or ldap server/saml etc ?

[D_Riddleberger]

OKTA Radius is used for authentication. We thought the same about missing file or file corruption on the SMS but so far, unable to reproduce.

[Ruan_Kotze]

Sounds like maybe your trac_client_1.ttm got modified during the upgrade.  Do you have a gateway that you haven't pushed policy to since the upgrade?  The SMS pushes it down during policy install so it would be worthwhile to compare.  Otherwise if you have a backup of the SMS pre-upgrade you should be able to pull it from there.

Some files do get overwritten during JHF upgrades. As an example it resets our "always prompt for MFA" settings on our VPN gateways.

We've resorted to running the backup script on Checkmates which backs up the custom config files.

[D_Riddleberger]

Hi Ruan,

We also thought the same. In the screen shot (below) is the SMS with HF-141 on Sept 10 and then HF-170 updated a couple of days later. You can see all the $FWDIR/conf  .ttm files remain untouched with the same date of Sept 10

[D_Riddleberger]

We have also re-engaged TAC to see if there are any possible compatibility issues with having the SMS at R81.20 HF-170 and the gateways still on R81.20 HF-141 as there has been a great deal of code updates between HF-141 and HF-170 to consider....

For HF-166

UPDATE: Resolved CVE-2026-85102 - Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN. Refer to sk1000117.

For HF-161

UPDATE: Resolved CVE-2026-18574 - Management Authentication Bypass. Refer to sk185222.

For HF-158

UPDATE: Resolved CVE-2026-62144 - Management Authentication Bypass and Privilege Escalation. Refer to sk185152.

UPDATE: Resolved CVE-2026-62145 - Local privilege escalation in Gaia Portal. Refer to sk185153.

UPDATE: Resolved CVE-2026-16232 - Authentication bypass with SmartConsole login process using application token. Refer to sk185169.

For HF-146

• Resolved CVE-2026-50751 - User Authentication bypass on VPN Remote Access and Mobile Access in deprecated IKEv1 key exchange. Refer to sk185033.
• Resolved CVE-2026-50752 VPN site-to-site certificate bypass vulnerability in deprecated IKEv1 key exchange. Refer to sk185035.