Check Point Frontier AI Models Readiness Program – Security Updates

[PhoneBoy]

At Check Point we don’t wait for threats to evolve; we evolve ahead of them. This is why we’ve been running our Frontier AI Models Readiness Program: a proactive, structured initiative designed to ensure that our products remain resilient as AI models grow increasingly capable of understanding complex software systems and assisting adversaries in attacking them.

As part of this program, we conducted large-scale AI-driven code scanning across our products, performed extensive security reviews, hardened components where needed, refined our time-to-patch procedures, and accelerated our protection development processes to meet the pace of emerging AI-driven threats.

The Jumbo Hotfixes released on May 26th is one of the first direct outcomes of that effort and includes fixes for the following CVEs:

CVE	Description	CVSS	In the Wild
CVE-2026-48131	VPND IKE Fragment Reassembly – Heap Out-of-Bounds Write via Sequence Number Zero	8.1	NO
CVE-2026-48132	VPN service may restart unexpectedly when processing IKE traffic over NAT-T (UDP/4500)	8.1	NO
CVE-2026-48133	NAC Captive Portal – Unauthenticated Local File Inclusion	7.5	NO
CVE-2026-48134	SQL injection issue in UserCheck Portal when DLP Software Blade is active	5.6	NO
CVE-2026-48135	Hardening the HTTP parser against malformed/malicious input	5.3	NO
CVE-2026-48136	Compliance Best Practice metadata manipulation issue when Compliance Software Blade is enabled	4.1	NO

While each CVE has mitigation steps associated with it that are provided in the SKs linked above, we recommend installing the JHF as it includes additional security hardening.

The releases that provide fixes for the above CVEs include:

• Jumbo Hotfix Accumulator for R82.10 starting from Take 19
• Jumbo Hotfix Accumulator for R82 starting from Take 103
• Jumbo Hotfix Accumulator for R81.20 starting from Take 141
• R81.10.17 for Spark Firewalls starting from build 996004892 - sk183153
• R82.00.10 for Spark Firewalls starting from build 998002203- sk184357

[sjni01]

Wow, Awesome, all this information led me to this interesting link about the Spark appliance

[ccsjnw]

That's great. Some very interesting improvements and security fixes.

I see JHFA Take 19 is now available for R82.10, but Take 6 hasn't been declared as Recommended yet, and it was released on 06 April 2026 (32 days ago as of now). As of 28 May 2026 there have been no recommended JHFA Takes released for R82.10 since GA2 was released on 24 December 2025 - there has only been the CRL Hotfix.

Can some guidance be given as to when a released JHFA Take is likely to be declared Recommended?
It doesn't appear to be related to the number of days since release.

JHFA Take 91 for R82 was declared as Recommended on 19th April 2026, and it was only released on 31 March 2026. (a gap of only 19 days).

Many of us who look after ARM based 3900 series appliances in production, won't even consider installing a JHFA until it reaches Recommended Status, so we are still running the initial release from December with just the CRL Hotfix installed.

[PhoneBoy]

Recommended status is usually declared after a level of adoption/stability is reached with existing fixes.
I know we are planning to make a JHF with these fixes recommended as soon as practical. 

[Steffen_Appel]

Regarding the file exposure from https://support.checkpoint.com/results/sk/sk184993 - which files are affected, or is it all files again like 2 years ago?

[PhoneBoy]

Looking at the available public information, the CVE from two years ago mentions: 

• CWE-200: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

For the CVE in sk184993:

• CWE-98: CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remo...

That plus the lower overall CVSS suggests a more limited scope.
Having said that, I don't know the details and suggest contacting TAC for a formal statement.